CVE-2026-118904: IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.
Published Nov 8, 2026
·Updated
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM webMethods Integration Serverto a version that resolves this vulnerability.Patch IS_12.1_Core_Fix1
Event History
Nov 8, 2026
CVE Published
via MITRE·07:48 PM
Data Sourced
via MITRE·07:48 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must be authenticated and have low-level privileges. No user interaction is required.
2
What security impact could successful exploitation have?
Successful exploitation could let an attacker bypass security restrictions, with high impact to confidentiality and integrity. The available data does not indicate an availability impact.
3
Which product version is identified as affected?
IBM webMethods Integration Server 12.1 is identified as affected.