← Vulnerability feed

Vulnerability record · CVE-2025-36037 · published 22 September 2025

CVE-2025-36037: Ibm webmethods integration server-side request forgery (ssrf) vulnerability

Ibm · Webmethods Integration

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

5.4 CVSS 3.1 Medium EPSS 0.19% · top 92.2% CWE-918 · Server-side request forgery (SSRF)
5.4CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7245758 Vendor Advisory

Track CVE-2025-36037 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-45076Ibm webmethods integration unrestricted file upload vulnerabilityIBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying op…EPSS 0.55%9.8CVE-2026-12118Ibm webmethods integration deserialization of untrusted data vulnerabilityIBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the d…EPSS 0.85%8.8CVE-2025-36072Ibm webmethods integration deserialization of untrusted data vulnerabilityIBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration…EPSS 0.47%8.8CVE-2025-36202Ibm webmethods integration vulnerabilityIBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to t…EPSS 0.34%8.8CVE-2025-36049Ibm webmethods integration xml external entity (xxe) vulnerabilityIBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML dat…EPSS 0.65%8.8CVE-2024-45075Ibm webmethods integration missing authentication for critical function vulnerabilityIBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to ad…EPSS 0.45%7.2CVE-2025-36048Ibm webmethods integration execution with unnecessary privileges vulnerabilityIBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external enti…EPSS 0.49%6.5CVE-2024-45074Ibm webmethods integration path traversal vulnerabilityIBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted …EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2025-36037), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.