Read the docs
TI-2026-02226 Aliases CVE-2026-2606GHSA-hr7m-p5p9-684r

IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read

Priority LOW 29CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMwebMethods API Gateway (on-prem)10.11 – 10.11_Fix32; 10.15 – 10.15_Fix27; 11.1 – 11.1_Fix7—No fix listedCNA
  • webMethods API Gateway (on-prem) VendorIBM Affected 10.11 – 10.11_Fix32; 10.15 – 10.15_Fix27; 11.1 – 11.1_Fix7 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ibm:webmethods_api_gateway:10.11:-:*:*:on-prem:*:*:*10.11VulnerableIBM
cpe:2.3:a:ibm:webmethods_api_gateway:10.11:fix32:*:*:on-prem:*:*:*10.11 fix32VulnerableIBM
cpe:2.3:a:ibm:webmethods_api_gateway:10.15:-:*:*:on-prem:*:*:*10.15VulnerableIBM
cpe:2.3:a:ibm:webmethods_api_gateway:10.15:fix27:*:*:on-prem:*:*:*10.15 fix27VulnerableIBM
cpe:2.3:a:ibm:webmethods_api_gateway:11.1:-:*:*:on-prem:*:*:*11.1VulnerableIBM
cpe:2.3:a:ibm:webmethods_api_gateway:11.1:fix7:*:*:on-prem:*:*:*11.1 fix7VulnerableIBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:10.11:-:*:*:on-prem:*:*:* Versions 10.11 Vulnerable ·IBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:10.11:fix32:*:*:on-prem:*:*:* Versions 10.11 fix32 Vulnerable ·IBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:10.15:-:*:*:on-prem:*:*:* Versions 10.15 Vulnerable ·IBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:10.15:fix27:*:*:on-prem:*:*:* Versions 10.15 fix27 Vulnerable ·IBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:11.1:-:*:*:on-prem:*:*:* Versions 11.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:webmethods_api_gateway:11.1:fix7:*:*:on-prem:*:*:* Versions 11.1 fix7 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2606
  2. 2026-10-03 Alias added: GHSA-hr7m-p5p9-684r

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences