CVE-2025-14290

MediumCVSS 5.4

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Risk Assessment

The risk involves the possibility of SSRF attacks, which could allow an attacker to access internal network resources, enumerate services, or facilitate further attacks on the infrastructure.

Recommendation

It is recommended to apply the appropriate fixes provided by IBM for the affected versions of Integration Server.

Other vulnerabilities in IBM webMethods Integration Server

CVE-2026-2310High
IBM webMethods Integration Server 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Original NVD description (English source)

IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS