Quick answers
- Is CVE-2026-118904 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118904 being exploited in the wild.
- How severe is CVE-2026-118904?
- High severity, with a CVSS score of 8.1, published 8 November 2026.
- Which products and versions are affected?
- IBM webMethods Integration Server 12.1.
- Is there a fix for CVE-2026-118904?
- Yes: fixed in IS_12.1_Core_Fix1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118904 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-118904?
- Check whether you run IBM webMethods Integration Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: IS_12.1_Core_Fix1 or later
Technical details
The vulnerability is an improper authentication issue (CWE-287) affecting backup code validation during 2FA authentication in IBM webMethods Integration Server. An authenticated attacker with network access can exploit this flaw without user interaction to bypass security restrictions. The attack succeeds because backup codes used as a 2FA fallback are not properly validated, allowing an attacker to circumvent the authentication control and gain unauthorized access.
Affected products
- IBM webMethods Integration Server 12.1
Timeline
- 2026-11-03: disclosed: Initial publication of IBM Security Bulletin
- 2026-11-08: advisory