IBM webMethods Integration Deserialization Vulnerability Leading to Arbitrary Code Execution

A vulnerability exists in IBM webMethods Integration versions 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6. This vulnerability allows an authenticated user to execute arbitrary code on the system, stemming from the deserialization of untrusted object graph data.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Users are advised to upgrade to IBM webMethods Integration IS_10.11_Core_Fix23 or later, IS_10.15_Core_Fix23 or later, or IS_11.1_Core_Fix7 or later. These fixes can be downloaded and installed via the IBM webMethods Update Manager. For more information on downloading webMethods software, refer to the IBM Support page node 7232491.