CVE-2025-36072
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceIBM webMethods Integration platforms allow an authenticated user to execute arbitrary code due to unsafe deserialization of untrusted data. This deserialization vulnerability enables remote code execution on affected systems by submitting crafted serialized objects that get deserialized without proper validation.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 10.11= 10.15= 11.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed IBM webMethods Integration versionCheck the product version through the webMethods Administrator UI (typically at /webmethods/Administrator) or by inspecting the release manifest files in the installation directory (such as Installer/regression/manifest.txt or the version info in the Integration Server directory)Affected if The installed version falls within 10.11 through 10.11_Core_Fix21, 10.15 through 10.15_Core_Fix21, or 11.1 through 11.1_Core_Fix5 (versions before the patched Core Fixes)
-
Confirm authentication is enabled for the Integration ServerVerify through the webMethods Administrator console that user authentication is required for accessing integration services, or check the security configuration files (typically in the Integration Server /config directory) for authentication settingsAffected if Authentication is disabled or set to None, which would actually make the vulnerability moot, but if authentication exists then any authenticated user could potentially exploit it
-
Identify users with elevated permissions or service execution rightsReview user accounts and groups in the webMethods Administrator under the Security or User Management section, focusing on accounts that have rights to invoke services that process serialized data or object graphsAffected if There are user accounts with permissions to execute integration services that handle deserialized objects, and the installed version is in the affected range
-
Locate services or pipelines that handle serialized Java objectsSearch the Integration Server repository or Designer for services that use Java object types in their pipeline or invoke external systems that may pass serialized data, particularly look for services using the pub.journal:deserialize or similar deserialization routinesAffected if The integration environment contains services that process untrusted serialized object data and the version is vulnerable
You are affected if your IBM webMethods Integration version is 10.11 through 10.11_Core_Fix21, 10.15 through 10.15_Core_Fix21, or 11.1 through 11.1_Core_Fix5 AND authenticated users can access services that perform deserialization of untrusted data.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedApply vendor-supplied patches: upgrade to 10.11_Core_Fix23, 10.15_Core_Fix23, or 11.1_Core_Fix7 or later. Until patches are applied, strictly limit access to authenticated users and monitor for indicators of compromise.
Upgrade to WebMethods Integration 10.11_Core_Fix23 or later, 10.15_Core_Fix23 or later, or 11.1_Core_Fix7 or later (verify exact fixed version from IBM Support)
- 1. Identify your current WebMethods Integration version and Core Fix level using the Administration UI or version command utilities
- 2. Review the IBM webMethods Integration release notes and IBM Support bulletins for CVE-2025-36072 to confirm the specific fixed Core Fix level for your version (10.11, 10.15, or 11.1)
- 3. If currently on 10.11_Core_Fix22 or earlier, 10.15_Core_Fix22 or earlier, or 11.1_Core_Fix6 or earlier, plan upgrade to a later Core Fix that includes the security fix
- 4. Back up all configuration files, databases, and custom integrations before applying any upgrade
- 5. Test the upgrade in a non-production environment to verify functionality
- 6. Apply the upgrade to production during a planned maintenance window
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation8.0 h
- Implementation12.0 h
- Testing12.0 h
- Review / QA6.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $10,624.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-36072 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-36072 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data