PT-2026-22805 · Ibm · Webmethods Api Management+1

Published 2026-03-03 · Updated 2026-03-05 · CVE-2026-2606

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM webMethods API Gateway (on-prem) versions 10.11 through 10.11 Fix3210.15 to 10.15 Fix2711.1 to 11.1 Fix7 IBM webMethods API Management (on-prem) versions 10.11 through 10.11 Fix3210.15 to 10.15 Fix2711.1 to 11.1 Fix7

Description The software does not properly validate user-supplied input provided to the url parameter on the /createapi API endpoint. An attacker can manipulate this parameter to utilize a file:// URI schema instead of the expected https:// schema, potentially allowing unauthorized access to arbitrary files on the underlying server file system.

Recommendations IBM webMethods API Gateway version 10.11 through 10.11 Fix3210.15 should be updated. IBM webMethods API Gateway version 10.15 Fix2711.1 should be updated. IBM webMethods API Gateway version 11.1 Fix7 should be updated. IBM webMethods API Management version 10.11 through 10.11 Fix3210.15 should be updated. IBM webMethods API Management version 10.15 Fix2711.1 should be updated. IBM webMethods API Management version 11.1 Fix7 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-2606

Affected Products

Webmethods Api Gateway

Webmethods Api Management

References · 6

• https://osv.dev/vulnerability/CVE-2026-2606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2606 · Security Note
• https://twitter.com/CVEnew/status/2028930724875612212 · Twitter Post
• https://ibm.com/support/pages/node/7261122 · Patch, Vendor Advisory
• https://twitter.com/infoflowcloud/status/2028932335924637941 · Twitter Post
• https://t.me/cveNotify/154404 · Telegram Post