First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-12118

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	webMethods Integration (on prem)	10.15, 10.11

References

https://www.ibm.com/support/pages/node/7278857Vendor Advisory

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1211808.8Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1211818.8Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1211828.8Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a c CVE-2026-1211838.3Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer pro CVE-2026-1211848.8Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside t CVE-2026-1211859.6Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execut CVE-2026-1211865.4UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering CVE-2026-1211875.3Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a craf CVE-2026-1211888.8Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the san CVE-2026-1211899.6Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox vi CVE-2026-121196.5The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontma CVE-2026-1211904.3UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof

CVE-2026-12118: Critical severity, CVSS 9.8 | Vulnix