Loading vulnerability…
Authenticated RCE via unsafe deserialization in IBM webMethods Integration Server
CVE-2025-36072 is a remote code execution vulnerability in IBM webMethods Integration Server caused by deserialization of untrusted Java object graphs. Affected versions include 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6. The flaw is exposed through the server’s handling of serialized object data via internal APIs or protocols such as IDataBin. An authenticated attacker with service execution privileges can submit a crafted serialized payload that abuses classes available on the server classpath to trigger a gadget chain during deserialization, resulting in arbitrary code execution in the Integration Server process context. The issue stems from insufficient validation and restriction of classes permitted during deserialization.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution with the privileges of the IBM webMethods Integration Server process. In enterprise deployments, this can lead to full compromise of the integration node, theft or manipulation of business data processed by integrations, lateral movement to connected internal systems, establishment of persistence, and broader disruption of business workflows that depend on the platform.
If you can’t patch tonight, do this now.
Until patched, restrict access to Integration Server service invocation and internal serialization pathways to only trusted administrative or application principals. Minimize the number of accounts with service execution privileges, segment the server from untrusted networks, and monitor for anomalous service invocations or deserialization-related activity. Where possible, reduce exposure of interfaces that accept serialized object data and review classpath contents for unnecessary libraries that could provide exploitable gadget chains.
Patch, then assume compromise.
Apply the latest IBM core fixes or vendor-provided security updates that address CVE-2025-36072 for affected IBM webMethods Integration Server releases. Specifically, deployments running 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, or 11.1 through 11.1_Core_Fix6 should be updated to a fixed level identified by IBM. Validate that all vulnerable nodes, including clustered and non-internet-facing instances, are upgraded consistently.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.