Advisory · CVE-2026-118904
IBM webMethods Integration Server authentication bypass opens restricted functions
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication, rated high at CVSS 8.1.
- Vendor
- IBM
- Product
- webMethods Integration Server
- Identifier / CWE
- CVE-2026-118904
CWE-287 - Action timing
- Immediate
Explain it like I’m five
webMethods Integration Server guards its functions with authentication checks. A flaw lets a logged-in user slip past those checks and reach functions they were not allowed to use.
- 01Authenticated access
A remote authenticated attacker reaches the Integration Server.
- 02Authentication check bypassed
The improper authentication handling is circumvented.
- 03Restricted function reached
Functions that should have required stronger authorization are used.
What happened
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. The record rates it high at CVSS 8.1 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
This shares the product and the flaw class with a sibling webMethods authentication bypass in the same release, under a separate bulletin. IBM’s bulletin lists the affected version and the fix.
What to do
- Inventory webMethods Integration Server deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review integration logs for unauthorized function use.
- Restrict network access to the server to trusted sources where possible.
- Verify the deployed version after updating.
Management note
Two authentication bypasses in one release means the checks need the patch, not a configuration tweak. Apply both fixes.