Vulnerability · Published Mar 3, 2026 · Assigned by ibm

CVE-2026-2606IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read

Medium 6.5

In plain English

A medium-severity path traversal in webMethods API Gateway (on-prem) from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

Affected products (as reported)

Vendor	Product	Versions
IBM	webMethods API Gateway (on-prem)	10.11 – through 10.11_Fix3210.15 – through 10.15_Fix2711.1 – through 11.1_Fix7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://www.ibm.com/support/pages/node/7261122 vendor-advisory, patch