{"id":"CVE-2026-123628","kind":"vulnerability","aliases":["CVE-2026-123628"],"related":[],"title":"IBM webMethods Integration Server 10.15 and 11.1 expose environment variables and Java runtime details through the admin/server/env API without login","description":"IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.","summary":"IBM's bulletin (12 Nov 2026) says on-prem webMethods Integration Server 10.15 up to IS_10.15_Core_Fix26 and 11.1 up to IS_11.1_Core_Fix11 can disclose server-side environment variables and Java runtime details to a remote attacker via an admin/server/env API request. CVSS 7.5 (AV:N/PR:N). IBM lists no workaround. No exploitation or PoC found.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM webMethods Integration Server 10.15","fixed":["IS_10.15_Core_Fix27"],"affected":"<= IS_10.15_Core_Fix26","ecosystem":"vendor"},{"name":"IBM webMethods Integration Server 11.1","fixed":["IS_11.1_Core_Fix12"],"affected":"<= IS_11.1_Core_Fix11","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm","integration-server","java","self-hosted","vendor","webmethods"],"not_affected_if":["fixed-core-fix","no-network-exposure","other-ibm-versions"],"how_to_check":"Check the installed Integration Server core fix level (Update Manager / installed fixes list). Exposed if 10.15 is at or below IS_10.15_Core_Fix26, or 11.1 at or below IS_11.1_Core_Fix11. Also check whether the admin/server/env path on the Integration Server port is reachable from untrusted networks; the bulletin does not give a test command or say what a request needs.","fix":"Apply IS_10.15_Core_Fix27 or later (10.15) or IS_11.1_Core_Fix12 or later (11.1), installed via IBM webMethods Update Manager and following the fix readme.","status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:25+00:00","updated_at":"2026-11-13T22:37:21+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-13T22:34:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM webMethods Integration Server leaks server environment variables and Java runtime details","impact":"low","summary":"IBM webMethods Integration Server 10.15 and 11.1 expose sensitive server-side environment variables and Java runtime details. A remote attacker can read this information without logging in, which can help them plan further attacks.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["webmethods","integration-server","ibm","java"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker reads server environment variables and Java runtime details","analyst_note":"Find the IBM security bulletin for CVE-2026-123628 to confirm affected endpoints, the fixed versions for 10.15 and 11.1, and any workaround.","how_to_check":"- Confirm the installed webMethods Integration Server version (10.15 or 11.1) in the product's admin console or installation directory.\n- unknown for other checks: the sources do not say which endpoint or setting exposes the data.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-ibm-versions","no-network-exposure"],"who_is_affected":"Organisations running IBM webMethods Integration Server 10.15 or 11.1 that accept network connections from outside their own network. The sources do not say which endpoints or configurations are involved, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000723,"input_tokens":4525,"output_tokens":540,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-123628 to confirm affected endpoints, the fixed versions for 10.15 and 11.1, and any workaround.","search":"'-123628':23A,26A '-2026':22A,25A '10.15':5A,31A,60B,64B,113C '11.1':7A,36A,68B,72B,115C '12':50B '2026':52B '7.5':96B 'admin/server/env':17A,92B 'allow':117C 'api':18A,93B 'attack':89B,120C 'av':97B 'bulletin':49B 'core':65B,73B 'could':116C 'cve':21A,24A 'cvss':95B 'detail':14A,85B,139C 'disclos':76B 'due':125C 'environ':9A,80B,134C 'exploit':105B 'expos':8A 'exposur':128C 'fix11':74B 'fix26':66B 'found':108B 'host':44B 'ibm':1A,27A,32A,37B,47B,100B,109C 'inform':124C 'integr':3A,39B,58B,111C 'integration':29A,34A 'integration-serv':38B 'java':12A,41B,83B,137C 'list':101B 'login':20A 'n':99B 'n/pr':98B 'nov':51B 'obtain':122C 'on-prem':54B 'poc':107B 'prem':56B 'remot':88B,119C 'request':94B 'runtim':13A,84B,138C 'say':53B 'self':43B 'self-host':42B 'sensit':123C,130C 'server':4A,30A,35A,40B,59B,78B,112C,132C 'server-sid':77B,131C 'side':79B,133C 'variabl':10A,81B,135C 'vendor':45B 'via':90B 'webmethod':2A,46B,57B,110C 'webmethods':28A,33A 'without':19A 'workaround':103B","nicknames":[],"mitigations":[],"who_affected":"Teams running on-prem IBM webMethods Integration Server 10.15 (up to IS_10.15_Core_Fix26) or 11.1 (up to IS_11.1_Core_Fix11). IBM says the flaw is in the admin/server/env API request and rates it as needing no login, so servers reachable from untrusted networks matter most. Environment variables often hold credentials, so rotate any secrets held there if the server was exposed. IBM does not list version 12.1 as affected.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:37:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296466","run_id":3946},"products":{"at":"2026-11-13T22:37:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296466","run_id":3946},"workarounds":{"at":"2026-11-13T22:37:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296466","run_id":3946}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmwebmethodsintegrationserver1015","ibmwebmethodsintegrationserver111","webmethodsintegrationserver1015","webmethodsintegrationserver111"],"ptokens":["10","11","15","ibm","integration","server","webmethods"],"labels":["high","ibm","integrationserver","java","selfhosted","vendor","webmethods"],"campaign_type":null,"search_a":"'-123628':23A,26A '-2026':22A,25A '10.15':5A,31A '11.1':7A,36A 'admin/server/env':17A 'api':18A 'cve':21A,24A 'detail':14A 'environ':9A 'expos':8A 'ibm':1A,27A,32A 'integr':3A 'integration':29A,34A 'java':12A 'login':20A 'runtim':13A 'server':4A,30A,35A 'variabl':10A 'webmethod':2A 'webmethods':28A,33A 'without':19A","search_b":"'10.15':60B,64B '11.1':68B,72B '12':50B '2026':52B '7.5':96B 'admin/server/env':92B 'api':93B 'attack':89B 'av':97B 'bulletin':49B 'core':65B,73B 'cvss':95B 'detail':85B 'disclos':76B 'environ':80B 'exploit':105B 'fix11':74B 'fix26':66B 'found':108B 'host':44B 'ibm':37B,47B,100B 'integr':39B,58B 'integration-serv':38B 'java':41B,83B 'list':101B 'n':99B 'n/pr':98B 'nov':51B 'on-prem':54B 'poc':107B 'prem':56B 'remot':88B 'request':94B 'runtim':84B 'say':53B 'self':43B 'self-host':42B 'server':40B,59B,78B 'server-sid':77B 'side':79B 'variabl':81B 'vendor':45B 'via':90B 'webmethod':46B,57B 'workaround':103B","search_c":"'10.15':113C '11.1':115C 'allow':117C 'attack':120C 'could':116C 'detail':139C 'due':125C 'environ':134C 'exposur':128C 'ibm':109C 'inform':124C 'integr':111C 'java':137C 'obtain':122C 'remot':119C 'runtim':138C 'sensit':123C,130C 'server':112C,132C 'server-sid':131C 'side':133C 'variabl':135C 'webmethod':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123628","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123628","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:22+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123628:3946","url":"https://www.ibm.com/support/pages/node/7296466","severity":null,"published_at":"2026-11-13T22:37:21+00:00","modified_at":"2026-11-13T22:37:21+00:00","first_seen_at":"2026-11-13T22:37:21+00:00","fetched_at":"2026-11-13T22:37:21+00:00","note":"Read IBM bulletin node/7296466: affected/fixed core fixes, workarounds none, endpoint admin/server/env. No exploitation evidence searched beyond bulletin; social search skipped (new CVE).","cites":["https://www.ibm.com/support/pages/node/7296466"]}],"documents":[{"id":150673,"url":"https://www.ibm.com/support/pages/node/7296466","title":"IBM Security Bulletin: webMethods Integration Server admin/server/env disclosure CVE-2026-123628","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}