High priorityDisclosed

Advisory · CVE-2026-117545

IBM webMethods Integration Server lets authenticated users bypass security restrictions

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication, rated high at CVSS 8.8.

Advisory published November 8, 2026Independent summary
Vendor
IBM
Product
webMethods Integration Server
Identifier / CWE
CVE-2026-117545
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

webMethods Integration Server guards its integrations with authentication checks. A flaw in those checks lets a logged-in user step around restrictions they were supposed to be stopped by.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote authenticated attacker reaches the Integration Server.

  2. 02Authentication flaw hit

    The improper authentication check is circumvented.

  3. 03Restrictions bypassed

    Security restrictions that should have blocked the request are skipped.

What happened

IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

IBM’s bulletin lists the affected version and the fix. An integration server sits between systems, so a bypass there reaches everything it connects.

What to do

  1. Inventory webMethods Integration Server deployments and record each version.
  2. Check the IBM bulletin for the fix and apply it.
  3. Review integration logs for requests that bypassed restrictions.
  4. Restrict network access to the server to trusted sources where possible.
  5. Verify the deployed version after updating.

Management note

An integration hub that lets users bypass restrictions is a bridge past every control downstream. Check what crossed it.