IBM WEBMETHODS INTEGRATION SERVER 10.15 · CVE-2026-123628 · Vendor
FIX → IS_10.15_Core_Fix27 · IS_11.1_Core_Fix12 ✓ verified
IBM's bulletin (12 Nov 2026) says on-prem webMethods Integration Server 10.15 up to IS_10.15_Core_Fix26 and 11.1 up to IS_11.1_Core_Fix11 can disclose server-side environment variables and Java runtime details to a remote attacker via an admin/server/env API request. CVSS 7.5 (AV:N/PR:N). IBM lists no workaround. No exploitation or PoC found.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running on-prem IBM webMethods Integration Server 10.15 (up to IS_10.15_Core_Fix26) or 11.1 (up to IS_11.1_Core_Fix11). IBM says the flaw is in the admin/server/env API request and rates it as needing no login, so servers reachable from untrusted networks matter most. Environment variables often hold credentials, so rotate any secrets held there if the server was exposed. IBM does not list version 12.1 as affected.
Not affected if fixed-core-fix, no-network-exposure, other-ibm-versions
Who cares ibm, integration-server, java, self-hosted, webmethods
IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to IS_10.15_Core_Fix27 · IS_11.1_Core_Fix12
Apply IS_10.15_Core_Fix27 or later (10.15) or IS_11.1_Core_Fix12 or later (11.1), installed via IBM webMethods Update Manager and following the fix readme.