PT-2025-38725 · Ibm · Webmethods Integration

Rob Maslen · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-36202

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration versions 10.15 and 11.1

Description An authenticated user with execute Services permissions may be able to execute commands on the system. This is due to improper validation of format string strings received from an external source.

Recommendations Apply updates to address improper validation of format string strings for IBM webMethods Integration version 10.15. Apply updates to address improper validation of format string strings for IBM webMethods Integration version 11.1.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2025-11544

CVE-2025-36202

Affected Products

Webmethods Integration

References · 5

• https://bdu.fstec.ru/vul/2025-11544 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36202 · Security Note
• https://twitter.com/CVEnew/status/1970153791799349617 · Twitter Post
• https://ibm.com/support/pages/node/7245720 · Vendor Advisory, Patch