Known vulnerabilities in webMethods BPM

Vendor: IBM Corporation
Software: webMethods BPM
Software CPE: cpe:2.3:a:ibm_corporation:webmethods_bpm:*:*:*:*:*:*:*:*
Website: https://www.ibm.com/us-en
Total vulnerabilities: 52
Public exploits: 8
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting webMethods BPM webMethods BPM is affected by 52 known vulnerabilities: 1 critical, 2 high, 39 medium, 10 low Critical High Medium Low

Vulnerabilities (52)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU128400 - Improper Output Neutralization for Logs
CVE-2026-34478		 CWE-117 Medium
No
No
 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 28.04.2026 SB20260428217
SB2026052632
SB2026052731
and 12 more
#VU128399 - Improper Certificate Validation
CVE-2026-34477		 CWE-295 Medium
No
No
 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 28.04.2026 SB20260428217
SB20260513128
SB2026052632
and 15 more
#VU126752 - Improper input validation
CVE-2026-27727		 CWE-20 High
No
No
 11.1 Fix 6 22.04.2026 SB20260422128
SB20260422169
SB20260422170
and 6 more
#VU126753 - Deserialization of Untrusted Data
CVE-2026-27830		 CWE-502 Medium
No
No
 11.1 Fix 6 22.04.2026 SB20260422128
SB20260422168
SB20260422170
and 7 more
#VU123883 - Resource exhaustion
CVE-2025-66453		 CWE-400 Low
No
No
 11.1 Fix 2 11.03.2026 SB2026031137
SB2026031139
SB2026032529
and 4 more
#VU120231 - Improper Validation of Certificate with Host Mismatch
CVE-2025-68161		 CWE-297 Medium
No
No
 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1 22.12.2025 SB2025122245
SB2026012084
SB2026012087
and 98 more
#VU86800 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2023-4218		 CWE-611 Low
No
No
 12.1 Fix 1 26.02.2024 SB2024022642
SB2024030105
SB2024032906
and 11 more
#VU81726 - Integer overflow
CVE-2023-36478		 CWE-190 Medium
No
No
 10.15 Fix 15, 11.1 Fix 3 10.10.2023 SB2023101018
SB2023102640
SB2023103106
and 53 more
#VU80791 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2023-40167		 CWE-444 Medium
No
No
 10.15 Fix 15, 11.1 Fix 3 14.09.2023 SB2023091440
SB2023092933
SB2023101760
and 68 more
#VU75217 - Improper input validation
CVE-2023-26049		 CWE-20 Low
No
No
 10.15 Fix 15, 11.1 Fix 3 18.04.2023 SB2023041842
SB2023051821
SB2023060836
and 78 more
#VU65831 - Improper input validation
CVE-2022-2047		 CWE-20 Low
No
No
 10.15 Fix 15, 11.1 Fix 3 27.07.2022 SB2022072723
SB2022080103
SB2022080260
and 41 more
#VU60367 - Security Features
CVE-2022-24329		 CWE-254 Medium
No
No
 11.1 Fix 1 08.02.2022 SB2022020805
SB2022042218
SB2022071957
and 13 more
#VU55164 - Improper input validation
CVE-2020-29582		 CWE-20 Medium
No
No
 11.1 Fix 1 21.07.2021 SB2021072128
SB2022012750
SB2022042257
and 8 more
#VU54856 - Resource exhaustion
CVE-2021-36374		 CWE-400 Medium
No
No
 11.1 Fix 9 14.07.2021 SB2021071409
SB2021072011
SB2021101927
and 43 more
#VU54855 - Resource exhaustion
CVE-2021-36373		 CWE-400 Medium
No
No
 11.1 Fix 9 14.07.2021 SB2021071409
SB2021072011
SB2022080830
and 16 more
#VU53973 - Improper input validation
CVE-2021-28169		 CWE-20 Medium
No
No
 10.15 Fix 15, 11.1 Fix 3 09.06.2021 SB2021060910
SB2021061815
SB2021081922
and 36 more
#VU52385 - Improper input validation
CVE-2020-27223		 CWE-20 Medium
Available
No
 10.15 Fix 15, 11.1 Fix 3 21.04.2021 SB2021042107
SB2021063002
SB2021063034
and 19 more
#VU52252 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-29425		 CWE-22 Low
No
No
 11.1 Fix 1 15.04.2021 SB2021041510
SB2021081922
SB2021093016
and 121 more
#VU27924 - Incorrect Default Permissions
CVE-2020-1945		 CWE-276 Low
No
No
 11.1 Fix 9 15.05.2020 SB2020051501
SB2020052114
SB2020060205
and 48 more
#VU47428 - Permissions, Privileges, and Access Controls
CVE-2020-11979		 CWE-264 Low
No
No
 11.1 Fix 9 14.05.2020 SB2020100804
SB2020100815
SB2020111614
and 51 more


Showing elements 1 - 20 out of 52