{"id":"CVE-2026-117545","kind":"vulnerability","aliases":["CVE-2026-117545"],"related":[],"title":"IBM webMethods Integration Server 12.1: authenticated users can bypass two-factor authentication","description":"IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.","summary":"IBM's bulletin (3 Nov 2026) says a remote authenticated attacker can bypass the two-factor authentication mechanism in IBM webMethods Integration Server 12.1 (on prem), CWE-287, CVSS 8.8. IBM lists no workaround. The fix is IS_12.1_Core_Fix1 or later.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webMethods Integration Server","fixed":["IS_12.1_Core_Fix1"],"affected":"12.1 (without IS_12.1_Core_Fix1)","ecosystem":"vendor"}],"ecosystems":[],"tags":["2fa-bypass","enterprise","ibm-webmethods","integration-server","on-prem","vendor"],"not_affected_if":["no-remote-login"],"how_to_check":"Check whether you run IBM webMethods Integration Server 12.1 on prem and whether IS_12.1_Core_Fix1 (or later) is installed. Check in webMethods Update Manager, which lists installed fixes. If it is not installed, you are exposed.","fix":"Apply IS_12.1_Core_Fix1 or later through IBM webMethods Update Manager, following the fix readme.","status":"open","published_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:13+00:00","updated_at":"2026-11-08T17:25:38+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T17:24:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM webMethods Integration Server 12.1: authenticated users can bypass security restrictions","impact":"medium","summary":"IBM webMethods Integration Server 12.1 has an improper authentication flaw that lets a logged-in remote user bypass security restrictions. An attacker with valid credentials could reach functions they should not be able to use.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-webmethods","integration-server","enterprise"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user bypasses restrictions and reaches protected functions","analyst_note":"Find IBM's security bulletin for CVE-2026-117545 to confirm affected sub-versions, the fixed release and the specific restricted functions.","how_to_check":"- Confirm the installed Integration Server version (`12.1`) against IBM's advisory\n- Check whether any ranges or fixed versions are listed in the IBM security bulletin: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-login"],"who_is_affected":"Organisations running IBM webMethods Integration Server 12.1 that allow remote users to log in. The sources do not name the affected sub-features or configurations. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4502,"output_tokens":500,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-117545 to confirm affected sub-versions, the fixed release and the specific restricted functions.","search":"'-117545':16A,19A '-2026':15A,18A '-287':65B '12.1':5A,61B,76B,85C '2026':42B '2fa':24B '2fa-bypass':23B '3':40B '8.8':67B 'allow':87C 'attack':47B,91C 'authent':6A,13A,46B,54B,90C,99C 'bulletin':39B 'bypass':9A,25B,49B,93C 'core':77B 'could':86C 'cve':14A,17A 'cvss':66B 'cwe':64B 'due':96C 'enterpris':26B 'factor':12A,53B 'fix':73B 'fix1':78B 'ibm':1A,28B,37B,57B,68B,81C 'ibm-webmethod':27B 'improp':98C 'integr':3A,31B,59B,83C 'integration':21A 'integration-serv':30B 'later':80B 'list':69B 'mechan':55B 'nov':41B 'on-prem':33B 'prem':35B,63B 'remot':45B,89C 'restrict':95C 'say':43B 'secur':94C 'server':4A,22A,32B,60B,84C 'two':11A,52B 'two-factor':10A,51B 'user':7A 'vendor':36B 'webmethod':2A,29B,58B,82C 'webmethods':20A 'workaround':71B","nicknames":[],"mitigations":[],"who_affected":"Teams running on-prem IBM webMethods Integration Server 12.1 where remote users log in. An attacker needs valid credentials, and the flaw lets them get past the two-factor authentication step. Other versions are not listed by IBM; its bulletin covers supported versions only. Anyone without Integration Server 12.1 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203},"products":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203},"mitigations":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203},"workarounds":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203},"how_to_check":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203},"who_affected":{"at":"2026-11-08T17:25:38Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295298","run_id":2203}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["integrationserver","webmethodsintegrationserver"],"ptokens":["integration","server","webmethods"],"labels":["2fabypass","enterprise","high","ibmwebmethods","integrationserver","onprem","vendor"],"campaign_type":null,"search_a":"'-117545':16A,19A '-2026':15A,18A '12.1':5A 'authent':6A,13A 'bypass':9A 'cve':14A,17A 'factor':12A 'ibm':1A 'integr':3A 'integration':21A 'server':4A,22A 'two':11A 'two-factor':10A 'user':7A 'webmethod':2A 'webmethods':20A","search_b":"'-287':65B '12.1':61B,76B '2026':42B '2fa':24B '2fa-bypass':23B '3':40B '8.8':67B 'attack':47B 'authent':46B,54B 'bulletin':39B 'bypass':25B,49B 'core':77B 'cvss':66B 'cwe':64B 'enterpris':26B 'factor':53B 'fix':73B 'fix1':78B 'ibm':28B,37B,57B,68B 'ibm-webmethod':27B 'integr':31B,59B 'integration-serv':30B 'later':80B 'list':69B 'mechan':55B 'nov':41B 'on-prem':33B 'prem':35B,63B 'remot':45B 'say':43B 'server':32B,60B 'two':52B 'two-factor':51B 'vendor':36B 'webmethod':29B,58B 'workaround':71B","search_c":"'12.1':85C 'allow':87C 'attack':91C 'authent':90C,99C 'bypass':93C 'could':86C 'due':96C 'ibm':81C 'improp':98C 'integr':83C 'remot':89C 'restrict':95C 'secur':94C 'server':84C 'webmethod':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117545","severity":null,"published_at":"2026-11-08T17:16:37+00:00","modified_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117545:2203","url":"https://www.ibm.com/support/pages/node/7295298","severity":null,"published_at":"2026-11-08T17:25:38+00:00","modified_at":"2026-11-08T17:25:38+00:00","first_seen_at":"2026-11-08T17:25:38+00:00","fetched_at":"2026-11-08T17:25:38+00:00","note":"Read IBM bulletin node/7295298: affected 12.1, fix IS_12.1_Core_Fix1 or later, workarounds none. Bulletin names 2FA bypass, not specific restricted functions. No exploitation or PoC seen (not searched on X; low-profile).","cites":["https://www.ibm.com/support/pages/node/7295298"]}],"documents":[{"id":102712,"url":"https://www.ibm.com/support/pages/node/7295298","title":"IBM Security Bulletin: webMethods Integration Server 2FA bypass CVE-2026-117545","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}