CVE-2025-14289
Received Received - Intake
HTML Injection in IBM webMethods Integration Server 12.0 Enables Remote Code Execution

Publication date: 2026-02-17

Last updated on: 2026-02-20

Assigner: IBM Corporation

Description
IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-17
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14289
EUVD
EUVD-2025-207721
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ibm webmethods_integration_server 12.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The IBM webMethods Integration Server version 12.0 is vulnerable to an HTML injection vulnerability identified as CVE-2025-14289.

This vulnerability occurs in the Security > Claims UI component, allowing a remote attacker to inject malicious HTML code.

When a victim views this injected content, the code executes within the security context of the hosting site, potentially leading to cross-site scripting (XSS) attacks.

It is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows a remote attacker to inject malicious HTML code that executes in the victim's web browser within the security context of the hosting site."}, {'type': 'paragraph', 'content': 'Such execution can lead to cross-site scripting (XSS) attacks, which may result in unauthorized actions performed on behalf of the user, theft of sensitive information, or session hijacking.'}, {'type': 'paragraph', 'content': 'The CVSS score indicates a low impact on confidentiality and integrity, no impact on availability, but the scope of the attack is changed, meaning it can affect resources beyond the vulnerable component.'}] [1]

Compliance Impact

I don't know

Detection Guidance

There are no specific detection methods or commands provided to identify this vulnerability on your network or system.

Mitigation Strategies

IBM recommends upgrading to webMethods Integration Server version 12.1 to remediate this vulnerability.

No workarounds or mitigations are provided other than the upgrade.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart