{"id":"CVE-2026-118904","kind":"vulnerability","aliases":["CVE-2026-118904"],"related":[],"title":"IBM webMethods Integration Server 12.1: 2FA backup code validation flaw lets authenticated users bypass security restrictions","description":"IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.","summary":"IBM says webMethods Integration Server 12.1 (on prem) has a flaw in backup code validation during 2FA authentication (CWE-287). A remote attacker with valid credentials can bypass security restrictions. IBM rates it CVSS 8.1. IBM lists no workarounds.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webMethods Integration Server","fixed":["IS_12.1_Core_Fix1"],"affected":"12.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["2fa","ibm-webmethods","integration-server","self-hosted","vendor"],"not_affected_if":["auth-required"],"how_to_check":"- Check whether you run IBM webMethods Integration Server 12.1 (the only version IBM lists) and whether 2FA with backup codes is used.\n- Check the installed fixes in webMethods Update Manager for IS_12.1_Core_Fix1 or later; if absent, you are exposed.","fix":"Apply IS_12.1_Core_Fix1 or later via IBM webMethods Update Manager and follow the fix readme. IBM lists no workarounds.","status":"open","published_at":"2026-11-08T20:17:23+00:00","first_seen_at":"2026-11-08T20:22:46+00:00","triaged_at":"2026-11-08T20:23:30+00:00","updated_at":"2026-11-08T20:24:08+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T20:23:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM webMethods Integration Server: authenticated users can bypass security restrictions","impact":"medium","summary":"IBM webMethods Integration Server 12.1 has an improper authentication flaw. A remote attacker who already holds valid credentials can bypass security restrictions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-webmethods","integration-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker bypasses access restrictions on the integration server","analyst_note":"Find the IBM security bulletin for CVE-2026-118904 to confirm affected builds, fixed version and any required configuration.","how_to_check":"- Confirm whether you run IBM webMethods Integration Server version `12.1`.\n- Review the IBM security bulletin for CVE-2026-118904 for the affected build range (unknown in the sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4502,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-118904 to confirm affected builds, fixed version and any required configuration.","search":"'-118904':19A,22A '-2026':18A,21A '-287':56B '12.1':5A,42B,80C '2fa':6A,26B,53B '8.1':71B 'allow':82C 'attack':59B,86C 'authent':12A,54B,85C,94C 'backup':7A,49B 'bypass':14A,64B,88C 'code':8A,50B 'could':81C 'credenti':62B 'cve':17A,20A 'cvss':70B 'cwe':55B 'due':91C 'flaw':10A,47B 'host':35B 'ibm':1A,28B,37B,67B,72B,76C 'ibm-webmethod':27B 'improp':93C 'integr':3A,31B,40B,78C 'integration':24A 'integration-serv':30B 'let':11A 'list':73B 'prem':44B 'rate':68B 'remot':58B,84C 'restrict':16A,66B,90C 'say':38B 'secur':15A,65B,89C 'self':34B 'self-host':33B 'server':4A,25A,32B,41B,79C 'user':13A 'valid':9A,51B,61B 'vendor':36B 'webmethod':2A,29B,39B,77C 'webmethods':23A 'workaround':75B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (on-prem) IBM webMethods Integration Server 12.1. The attacker needs valid credentials, and the flaw is in backup code validation during 2FA login. Others can skip it, including anyone on other versions IBM does not list; note IBM lists only supported versions, so older releases are not confirmed clean.","tier":"B","verified":{"fix":{"at":"2026-11-08T20:24:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295306","run_id":2222},"products":{"at":"2026-11-08T20:24:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295306","run_id":2222},"workarounds":{"at":"2026-11-08T20:24:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295306","run_id":2222},"how_to_check":{"at":"2026-11-08T20:24:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295306","run_id":2222},"who_affected":{"at":"2026-11-08T20:24:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295306","run_id":2222}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["integrationserver","webmethodsintegrationserver"],"ptokens":["integration","server","webmethods"],"labels":["2fa","high","ibmwebmethods","integrationserver","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118904':19A,22A '-2026':18A,21A '12.1':5A '2fa':6A 'authent':12A 'backup':7A 'bypass':14A 'code':8A 'cve':17A,20A 'flaw':10A 'ibm':1A 'integr':3A 'integration':24A 'let':11A 'restrict':16A 'secur':15A 'server':4A,25A 'user':13A 'valid':9A 'webmethod':2A 'webmethods':23A","search_b":"'-287':56B '12.1':42B '2fa':26B,53B '8.1':71B 'attack':59B 'authent':54B 'backup':49B 'bypass':64B 'code':50B 'credenti':62B 'cvss':70B 'cwe':55B 'flaw':47B 'host':35B 'ibm':28B,37B,67B,72B 'ibm-webmethod':27B 'integr':31B,40B 'integration-serv':30B 'list':73B 'prem':44B 'rate':68B 'remot':58B 'restrict':66B 'say':38B 'secur':65B 'self':34B 'self-host':33B 'server':32B,41B 'valid':51B,61B 'vendor':36B 'webmethod':29B,39B 'workaround':75B","search_c":"'12.1':80C 'allow':82C 'attack':86C 'authent':85C,94C 'bypass':88C 'could':81C 'due':91C 'ibm':76C 'improp':93C 'integr':78C 'remot':84C 'restrict':90C 'secur':89C 'server':79C 'webmethod':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118904","severity":null,"published_at":"2026-11-08T20:17:23+00:00","modified_at":"2026-11-08T20:17:24+00:00","first_seen_at":"2026-11-08T20:22:46+00:00","fetched_at":"2026-11-08T20:22:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118904:2222","url":"https://www.ibm.com/support/pages/node/7295306","severity":null,"published_at":"2026-11-08T20:24:08+00:00","modified_at":"2026-11-08T20:24:08+00:00","first_seen_at":"2026-11-08T20:24:08+00:00","fetched_at":"2026-11-08T20:24:08+00:00","note":"Read IBM bulletin node/7295306 (3 Nov 2026): 12.1 affected, fix IS_12.1_Core_Fix1 or later, no workarounds. No exploitation or PoC checked beyond bulletin; X not searched.","cites":["https://www.ibm.com/support/pages/node/7295306"]}],"documents":[{"id":103523,"url":"https://www.ibm.com/support/pages/node/7295306","title":"IBM Security Bulletin: webMethods Integration Server backup code validation during 2FA (CVE-2026-118904)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}