WEBMETHODS INTEGRATION SERVER · CVE-2026-118904 · Vendor
FIX → IS_12.1_Core_Fix1 ✓ verified
IBM says webMethods Integration Server 12.1 (on prem) has a flaw in backup code validation during 2FA authentication (CWE-287). A remote attacker with valid credentials can bypass security restrictions. IBM rates it CVSS 8.1. IBM lists no workarounds.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-managed (on-prem) IBM webMethods Integration Server 12.1. The attacker needs valid credentials, and the flaw is in backup code validation during 2FA login. Others can skip it, including anyone on other versions IBM does not list; note IBM lists only supported versions, so older releases are not confirmed clean.
Not affected if auth-required
Who cares 2fa, ibm-webmethods, integration-server, self-hosted
Upgrade to IS_12.1_Core_Fix1
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.