IBM Webmethods Integration Server vulnerabilities

3 CVEs affecting IBM Webmethods Integration Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2310, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-2310, published 2026-09-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this…
CVE-2025-14289, published 2026-02-17. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the…
CVE-2025-14290, published 2026-05-26. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF).…