IBM Enterprise Middleware Flaws Expose WebSphere and webMethods to RCE
Patch & Detection Intelligence · 2 sources · Updated 4mo ago · First seen Jun 5, 2026
IBM disclosed multiple high-severity vulnerabilities affecting WebSphere and webMethods Integration Server, exposing enterprise middleware environments to remote compromise. In WebSphere, the reported issues include remote code execution flaws tracked as CVE-2026-9311, CVE-2026-9330, and CVE-2026-9319, alongside an authentication bypass and identity spoofing issue, CVE-2026-8644. Affected deployments include traditional WebSphere versions 9.0 and 8.5, with IBM issuing interim fixes through specific APARs and urging administrators to verify configurations and apply patches quickly.
A separate IBM advisory covers webMethods Integration Server CVE-2025-36072, a deserialization-based remote code execution flaw that can be exploited by an authenticated attacker with service execution privileges through internal APIs or protocols such as IDataBin. The vulnerability affects versions 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 if they have not received the latest core fixes. Successful exploitation could allow arbitrary code execution in the Integration Server process, enabling lateral movement, persistence, and data exfiltration across business-critical systems.
