CVE-2026-2310
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-91
- Published
- 2026-09-10
- Last modified
- 2026-09-10
Affected products
- IBM webMethods Integration Server
Weakness type
Related vulnerabilities
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83616 — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-83608 — xmldom: DocType `name` Injection Bypasses requireWellFormed
- CVE-2026-83607 — xmldom: Element name injection via createElement() bypasses requireWellFormed
- CVE-2026-83605 — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
- CVE-2026-48590 — Element and Attribute Names Injected Verbatim into XML Output in xml_builder