CVE-2026-12118: Critical RCE in IBM webMethods (CVSS 9.8)

CVE-2026-12118 is a deserialization vulnerability affecting IBM webMethods Integration (on-premise versions 10.15 and 10.11). The flaw allows an unauthenticated remote attacker to execute arbitrary code on the system. webMethods Integration is a critical enterprise platform for system interoperability: its compromise exposes the entire chain of business integrations to threat actors.

The CVSS score is 9.8 with declared severity of critical: the highest risk level. The vulnerability was published in the NVD on July 30, 2026. A critical factor is the availability of a proof of concept (POC) publicly accessible on GitHub as of October 29, 2026. The status of official remediation is not currently reported in available security data.

System administrators running IBM webMethods Integration 10.15 or 10.11 must immediately verify the presence of vulnerable instances in their infrastructure; consult IBM advisories for patch availability and timelines; implement network access controls to limit the remote exposure of the platform; monitor system and application logs for signs of exploitation. The public availability of a POC significantly increases the risk of active attacks.