IBM webMethods Integration Server 11.1 XXE Vulnerability in XML Processing
CVE-2026-2310 Published on September 10, 2026
IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Vulnerability Analysis
CVE-2026-2310 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an aka Blind XPath Injection Vulnerability?
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Within XML, special elements could include reserved words or characters such as "<", ">", """, and "&", which could then be used to add new data or modify XML syntax.
CVE-2026-2310 has been classified to as an aka Blind XPath Injection vulnerability or weakness.
Products Associated with CVE-2026-2310
Want to know whenever a new CVE is published for IBM Webmethods Integration Server? stack.watch will email you.
