VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 3, 2026· Updated Jun 17, 2026

CVE-2026-2606

CVE-2026-2606

Description

IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • IBM/Webmethods API Gatewayllm-fuzzy8 versions
    10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7+ 7 more
    • (no CPE)range: 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7
    • cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11:*:*:*:*:*:*:*range: 10.11
    • cpe:2.3:a:ibm:webmethods_api_gateway:10.11:-:*:*:on-prem:*:*:*
    • cpe:2.3:a:ibm:webmethods_api_gateway:10.11:fix32:*:*:on-prem:*:*:*
    • cpe:2.3:a:ibm:webmethods_api_gateway:10.15:-:*:*:on-prem:*:*:*
    • cpe:2.3:a:ibm:webmethods_api_gateway:10.15:fix27:*:*:on-prem:*:*:*
    • cpe:2.3:a:ibm:webmethods_api_gateway:11.1:-:*:*:on-prem:*:*:*
    • cpe:2.3:a:ibm:webmethods_api_gateway:11.1:fix7:*:*:on-prem:*:*:*
  • IBM/webMethods API Managementllm-create
    Range: 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.