CVE-2026-2310: IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data
IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM webMethods Integration Server 11.1to a version that resolves this vulnerability.Fixed in 11.1Patch IS_11.1_Core_Fix14
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The provided data identifies IBM webMethods Integration Server version 11.1. It does not state whether other versions, editions, or default configurations are affected.
What access does an attacker need according to the supplied severity vector?
The CVSS vector indicates local attack vector (AV:L), low privileges required (PR:L), and no user interaction (UI:N). This conflicts with the description’s reference to a remote attacker, so the supplied data does not establish the exact exposure path.
What is the potential impact if exploitation succeeds?
The severity vector rates confidentiality, integrity, and availability impacts as high. The description specifically notes possible exposure of sensitive information and memory-resource consumption.