CVE-2025-36202
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.34%
- CWE
- CWE-134
- Published
- 2025-09-22
- Last modified
- 2026-03-13
Affected products
- IBM webMethods Integration
- IBM webMethods Integration
Weakness type
Related vulnerabilities
- CVE-2026-69395 — Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability
- CVE-2026-16821 — Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-81574 — Format String Vulnerability in Logger
- CVE-2026-63073 — Untrusted Sender DN Used as Format String in CMP Response Validation
- CVE-2026-17136 — Vulnerabilities in IBM AIX and PowerVM VIOS
- CVE-2026-68553 — Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
- CVE-2026-15961 — Power System Information Disclosure
- CVE-2026-12004 — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access