IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserializat…

CVE-2026-12118 is a critical vulnerability affecting IBM webMethods Integration (on-premises) versions 10.15 and 10.11. The flaw allows an unauthenticated remote attacker to execute arbitrary code on the affected system. The root cause is the deserialization of untrusted data, a well-known and dangerous vulnerability class. No authentication is required to exploit this vulnerability, making it particularly severe. The vulnerability has been assigned a high criticality rating. IBM has published a support advisory with remediation guidance. The vulnerability is currently awaiting full analysis by NVD. Organizations running the affected versions should review IBM's advisory and apply patches promptly.