CVE-2026-2310

HighCVSS 7.8

Published: 10/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

IBM webMethods Integration Server 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Risk Assessment

A remote attacker could gain access to sensitive data or cause memory exhaustion, potentially disrupting integration services.

Recommendation

Apply available fixes for IBM webMethods Integration Server 11.1 or disable external XML entity processing in the server configuration.

Other vulnerabilities in IBM webMethods Integration Server

CVE-2025-14290Medium
IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Original NVD description (English source)

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS