CVE-2026-2606

IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read

State: Published
Severity: 6.5 Medium
Published: Mar 3, 2026
Updated: Mar 4, 2026
Reserved: Feb 16, 2026

Description

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	ibm

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
webMethods API Gateway (on-prem)IBM	10.11 through 10.11_Fix32Affected 10.15 through 10.15_Fix27Affected 11.1 through 11.1_Fix7Affected

References

https://www.ibm.com/support/pages/node/7261122vendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.