PT-2025-47639 · Ibm · Webmethods Integration

Published 2025-11-20 · Updated 2025-12-15 · CVE-2025-36072

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration versions 10.11 through 10.11 Core Fix22 IBM webMethods Integration versions 10.15 through 10.15 Core Fix22 IBM webMethods Integration versions 11.1 through 11.1 Core Fix6

Description IBM webMethods Integration allows an authenticated user to execute arbitrary code on the system. This is caused by the deserialization of untrusted object graphs data.

Recommendations IBM webMethods Integration versions 10.11 through 10.11 Core Fix22 should be updated. IBM webMethods Integration versions 10.15 through 10.15 Core Fix22 should be updated. IBM webMethods Integration versions 11.1 through 11.1 Core Fix6 should be updated.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-14677

CVE-2025-36072

Affected Products

Webmethods Integration

References · 11

• https://bdu.fstec.ru/vul/2025-14677 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36072 · Security Note
• https://twitter.com/CVEnew/status/1991640311739871314 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991704038946013554 · Twitter Post
• https://twitter.com/CveFindCom/status/1991652851832049812 · Twitter Post
• https://t.me/CVEtracker/37879 · Telegram Post
• https://ibm.com/support/pages/node/7252090 · Patch, Vendor Advisory
• https://twitter.com/ZeroPathLabs/status/1991649672419492030 · Twitter Post
• https://t.me/cveNotify/145765 · Telegram Post
• https://t.me/cveNotify/143512 · Telegram Post