Introduction
When authenticated users can run code remotely on enterprise integration infrastructure, they can compromise business-critical workflows and data. CVE-2025-36072 puts IBM webMethods Integration Server deployments at exactly this risk: an attacker with valid credentials can trigger arbitrary code execution through unsafe deserialization.
About IBM webMethods Integration Server: IBM webMethods Integration Server is a widely adopted enterprise application integration platform. Software AG originally developed it, and it is now part of IBM's integration portfolio. Large organizations use it to connect disparate business applications and automate workflows. Because it plays a critical role in enterprise environments, its vulnerabilities can have significant operational and security impact.
Technical Information
CVE-2025-36072 is a deserialization vulnerability (CWE-502) in IBM webMethods Integration Server. The flaw is in how the server handles serialized Java object graphs received through internal APIs or protocols such as IDataBin. The server does not sufficiently validate or restrict which classes can be deserialized, so an attacker can submit a crafted serialized object graph that uses a gadget chain present in the classpath.
The attacker must be authenticated and have service execution privileges. Sending a malicious serialized object to the vulnerable endpoint starts the deserialization process. If the object graph is built to exploit a gadget chain, arbitrary code runs with the privileges of the Integration Server process. From there, an attacker could move laterally, exfiltrate data, or gain persistent access within the enterprise network.
No public code snippets or proof-of-concept details are available for this vulnerability. The attack needs no user interaction beyond authentication and service invocation.
Affected Systems and Versions
- IBM webMethods Integration Server 10.11 through 10.11_Core_Fix22
- IBM webMethods Integration Server 10.15 through 10.15_Core_Fix22
- IBM webMethods Integration Server 11.1 through 11.1_Core_Fix6
Any deployment running these versions without the latest core fixes is vulnerable. To exploit it, the attacker must be authenticated with service execution privileges.
Vendor Security History
IBM webMethods Integration Server and related products have had multiple deserialization and input validation vulnerabilities in recent years. Earlier advisories covered similar flaws, including remote code execution through unsafe deserialization and format string vulnerabilities. IBM typically issues security bulletins and patches in a timely manner, but because these issues keep recurring, enterprise customers need to stay alert and patch quickly.
