CVE-2026-12118 is a critical vulnerability in IBM webMethods Integration (on prem) versions 10.15 and 10.11, caused by unsafe deserialization of untrusted data. This vulnerability permits unauthenticated remote attackers to execute arbitrary code on the system. The CVSS 3.1 base score is 9.8, reflecting the ease of exploitation (network vector, no privileges, no user interaction) and the severe impact on confidentiality, integrity, and availability. As of the published date, no official fix or remediation level has been disclosed by IBM.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, data manipulation, or service disruption. The critical CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability without requiring any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the affected IBM webMethods Integration instances and monitor for unusual activity. Follow IBM's official communications for updates on patches or mitigations.