CVE-2025-36202
BaseFortify
Publication date: 2025-09-22
Last updated on: 2025-10-03
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | webmethods_integration | 10.5 |
| ibm | webmethods_integration | 11.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-134 | The product uses a function that accepts a format string as an argument, but the format string originates from an external source. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM webMethods Integration 10.15 and 11.1 allows an authenticated user who has the required execute Services permission to run commands on the system. This happens because the software improperly validates format string arguments passed from an external source, which can be exploited to execute arbitrary commands.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized command execution on the affected system by an authenticated user with certain permissions. This can result in full compromise of confidentiality, integrity, and availability of the system, potentially allowing attackers to manipulate data, disrupt services, or gain further access.