---
id: "CVE-2026-123628"
page: "https://infrastack.ai/live/CVE-2026-123628"
kind: "vulnerability"
aliases: ["CVE-2026-123628"]
title: "IBM webMethods Integration Server 10.15 and 11.1 expose environment variables and Java runtime details through the admin/server/env API without login"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM webMethods Integration Server 10.15", "fixed": ["IS_10.15_Core_Fix27"], "affected": "<= IS_10.15_Core_Fix26", "ecosystem": "vendor"}, {"name": "IBM webMethods Integration Server 11.1", "fixed": ["IS_11.1_Core_Fix12"], "affected": "<= IS_11.1_Core_Fix11", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm", "integration-server", "java", "self-hosted", "vendor", "webmethods"]
not_affected_if: ["fixed-core-fix", "no-network-exposure", "other-ibm-versions"]
published_at: "2026-11-13T22:17:21+00:00"
first_seen_at: "2026-11-13T22:33:34+00:00"
updated_at: "2026-11-13T22:37:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123628", "first_seen_at": "2026-11-13T22:33:34+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7296466", "first_seen_at": "2026-11-13T22:37:21+00:00", "cites": ["https://www.ibm.com/support/pages/node/7296466"]}]
exploit_sources: []
---

# IBM webMethods Integration Server 10.15 and 11.1 expose environment variables and Java runtime details through the admin/server/env API without login

Link for people: https://infrastack.ai/live/CVE-2026-123628 (this .md is for agents)

IBM's bulletin (12 Nov 2026) says on-prem webMethods Integration Server 10.15 up to IS_10.15_Core_Fix26 and 11.1 up to IS_11.1_Core_Fix11 can disclose server-side environment variables and Java runtime details to a remote attacker via an admin/server/env API request. CVSS 7.5 (AV:N/PR:N). IBM lists no workaround. No exploitation or PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM webMethods Integration Server 10.15 affected <= IS_10.15_Core_Fix26 fixed IS_10.15_Core_Fix27
- vendor:IBM webMethods Integration Server 11.1 affected <= IS_11.1_Core_Fix11 fixed IS_11.1_Core_Fix12

## How to check

Check the installed Integration Server core fix level (Update Manager / installed fixes list). Exposed if 10.15 is at or below IS_10.15_Core_Fix26, or 11.1 at or below IS_11.1_Core_Fix11. Also check whether the admin/server/env path on the Integration Server port is reachable from untrusted networks; the bulletin does not give a test command or say what a request needs.

## Fix

Apply IS_10.15_Core_Fix27 or later (10.15) or IS_11.1_Core_Fix12 or later (11.1), installed via IBM webMethods Update Manager and following the fix readme.

## Timeline

- 2026-11-13T22:33:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123628
- 2026-11-13T22:37:21+00:00 analyst https://www.ibm.com/support/pages/node/7296466 — Read IBM bulletin node/7296466: affected/fixed core fixes, workarounds none, endpoint admin/server/env. No exploitation evidence searched beyond bulletin; social search skipped (new CVE).

## Documents

- [advisory] IBM Security Bulletin: webMethods Integration Server admin/server/env disclosure CVE-2026-123628 https://www.ibm.com/support/pages/node/7296466

## From the sources

IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_