CVE-2026-12118 is a critical unsafe deserialization flaw (CVSS 9.8) in IBM webMethods Integration on prem. An unauthenticated remote attacker could run arbitrary code. IBM says the vulnerable WmServiceMock component is bundled with Integration Server and has fixes for versions 10.15, 11.1 and 12.1.
What's affected
From the CVE record and IBM's security bulletin:
- Product: IBM webMethods Integration (on prem). The CVE record names 10.15 and 10.11. IBM's bulletin lists 10.15, 11.1 and 12.1 in its affected table. Check your version against both lists.
- Component: WmServiceMock, which IBM says is bundled with IBM webMethods Integration Server.
- Fixes for 10.15: GWM_10.15_wMTestSuiteCommonLib_Fix4, GWM_10.15_wMTestSuiteDesigner_Fix4 and GWM_10.15_wMTestSuiteServer_Fix4.
- Fixes for 11.1: GWM_11.1_wMTestSuiteCommonLib_Fix4, GWM_11.1_wMTestSuiteDesigner_Fix4 and GWM_11.1_wMTestSuiteServer_Fix4.
- Fixes for 12.1: GWM_12.1_wMTestSuiteCommonLib_Fix1, GWM_12.1_wMTestSuiteDesigner_Fix1 and GWM_12.1_wMTestSuiteServer_Fix1.
- Workarounds: IBM lists none.
- Weakness class: CWE-502 (deserialization of untrusted data).
- Severity: CVSS 9.8, network reachable with no privileges and no user interaction.
How to check if you're exposed
Work out whether Integration Server in your estate has the mock component and which version it runs.
- List your IBM webMethods Integration on prem installs and their versions. The record and bulletin together cover 10.11, 10.15, 11.1 and 12.1.
- In the Integration Server administration interface, look at the list of installed packages for WmServiceMock. If it is present, treat the server as in scope.
- Check which test suite fixes are installed through your usual fix management process, and compare with the fix names above.
- Check whether Integration Server ports are reachable from untrusted networks. A server that only internal callers can reach is a lower priority than one on the internet, but both need the fix.
We have not confirmed an installed package listing format in the bulletin, so follow IBM's remediation steps for the exact install procedure.
What to do now
- Inventory every on prem webMethods Integration Server and record its version.
- Apply the three fixes that match the version, using the names in the IBM bulletin, in a test environment first.
- Restrict network access to Integration Server so that only the callers and administrators you expect can reach it.
- After patching, confirm the fix names appear as installed and restart where IBM's instructions require it.
- Plan for the 10.11 case: the CVE record names it, but the IBM bulletin does not list a fix for it. Ask IBM Support how to remediate or plan an upgrade to a supported release.
Why it matters
Deserialization turns a stream of bytes back into live objects. If the stream comes from an attacker and the program does not restrict which object types it will build, the act of reading the data can start a chain of code that the attacker chose. The result in the worst case is remote code execution, which matches the record.
IBM says the flaw sits in WmServiceMock, which is bundled with Integration Server. That is a useful detail: a testing component that ships with a production server gets installed whether or not anyone uses it. The CVSS vector shows no privileges and no user interaction, and High impact on all three security properties, so the score of 9.8 is not a surprise. It is not in the CISA Known Exploited Vulnerabilities catalog, and the bulletin does not claim exploitation.
Quick check
Do I need the fix if we do not use service mocking?
The component is bundled with Integration Server, so it can be present without being used. Check for WmServiceMock and apply the fixes if it is installed.
Why does the record say 10.11 when IBM lists 11.1?
The two sources differ. Treat any of 10.11, 10.15, 11.1 and 12.1 as in scope, and ask IBM Support about versions that the bulletin does not list a fix for.
Sources
- Gold entry and CVE record: CVE-2026-12118.
- IBM security bulletin for CVE-2026-12118, initial publication 2 July 2026.
Last reviewed: 19 October 2026.
