IBM Webmethods Integration vulnerabilities

9 CVEs affecting IBM Webmethods Integration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12118, published 2026-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12118, published 2026-07-30. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2025-36049, published 2025-06-18. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit…
CVE-2024-45076, published 2024-09-04. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.
CVE-2025-36048, published 2025-06-18. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges.
CVE-2024-45074, published 2024-09-04. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../)…
CVE-2025-36072, published 2025-11-20. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary…
CVE-2024-45075, published 2024-09-04. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.
CVE-2025-36202, published 2025-09-22. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings…
CVE-2025-36037, published 2025-09-22. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially…