Unrated severityNVD Advisory· Published Mar 3, 2026· Updated Mar 4, 2026
IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read
CVE-2026-2606
Description
IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.
Affected products
3- IBM/webMethods API Gateway (on-prem)v5cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11:*:*:*:*:*:*:*Range: 10.11
- Range: 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7
- Range: 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.ibm.com/support/pages/node/7261122mitrevendor-advisorypatch
News mentions
0No linked articles in our index yet.