Vulnerability · Published Nov 20, 2025 · Assigned by ibm

CVE-2025-36072IBM webMethods Integration Deserialization

High 8.8

In plain English

A high-severity unsafe deserialization in webMethods Integration from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data.

Affected products (as reported)

Vendor	Product	Versions
IBM	webMethods Integration	10.11 – through 10.11_Core_Fix2210.15 – through 10.15_Core_Fix2211.1 – through 11.1_Core_Fix6

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.ibm.com/support/pages/node/7252090 vendor-advisory, patch