IBM webMethods Integration Deserialization
Priority MEDIUM 41CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | webMethods Integration | 10.11 – 10.11_Core_Fix22; 10.15 – 10.15_Core_Fix22; 11.1 – 11.1_Core_Fix6 | — | No fix listed | CNA |
- webMethods Integration VendorIBM Affected 10.11 – 10.11_Core_Fix22; 10.15 – 10.15_Core_Fix22; 11.1 – 11.1_Core_Fix6 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:webmethods_integration:10.11:-:*:*:*:*:*:* | 10.11 | Vulnerable | IBM |
| cpe:2.3:a:ibm:webmethods_integration:10.11:core_fix22:*:*:*:*:*:* | 10.11 core_fix22 | Vulnerable | IBM |
| cpe:2.3:a:ibm:webmethods_integration:10.15:-:*:*:*:*:*:* | 10.15 | Vulnerable | IBM |
| cpe:2.3:a:ibm:webmethods_integration:10.15:core_fix22:*:*:*:*:*:* | 10.15 core_fix22 | Vulnerable | IBM |
| cpe:2.3:a:ibm:webmethods_integration:11.1:-:*:*:*:*:*:* | 11.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:webmethods_integration:11.1:core_fix6:*:*:*:*:*:* | 11.1 core_fix6 | Vulnerable | IBM |
- cpe:2.3:a:ibm:webmethods_integration:10.11:-:*:*:*:*:*:* Versions 10.11 Vulnerable ·IBM
- cpe:2.3:a:ibm:webmethods_integration:10.11:core_fix22:*:*:*:*:*:* Versions 10.11 core_fix22 Vulnerable ·IBM
- cpe:2.3:a:ibm:webmethods_integration:10.15:-:*:*:*:*:*:* Versions 10.15 Vulnerable ·IBM
- cpe:2.3:a:ibm:webmethods_integration:10.15:core_fix22:*:*:*:*:*:* Versions 10.15 core_fix22 Vulnerable ·IBM
- cpe:2.3:a:ibm:webmethods_integration:11.1:-:*:*:*:*:*:* Versions 11.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:webmethods_integration:11.1:core_fix6:*:*:*:*:*:* Versions 11.1 core_fix6 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-36072
- 2026-10-03 Alias added: GHSA-62xf-7472-gxwj
References
More IBM Webmethods Integration vulnerabilities
- TI-2026-10436 Deserialization of untrusted data in IBM webMethods Integration CVSS 3.1CRITICAL 9.8
- TI-2024-30185 IBM webMethods Integration code execution CVSS 3.1CRITICAL 9.9
- TI-2025-24656 IBM webMethods Integration Sever XML external entity injection CVSS 3.1HIGH 8.8
- TI-2025-24754 IBM webMethods Integration code execution CVSS 3.1HIGH 8.8
- TI-2024-30184 IBM webMethods Integration privilege escalation CVSS 3.1HIGH 8.8
- TI-2025-24655 IBM webMethods Integration Sever code execution CVSS 3.1HIGH 7.2
Sources
- CVE-2025-36072 · CVE Program
- CVE-2025-36072 · NVD
- FIRST EPSS
- GHSA-62xf-7472-gxwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences