CVE-2026-2606

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2606", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-02-16T22:12:35.250Z", "datePublished": "2026-03-03T19:38:30.609Z", "dateUpdated": "2026-03-04T21:11:13.359Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11_fix3210.15:*:*:*:*:*:*:*"], "product": "webMethods API Gateway (on-prem)", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.11_Fix32", "status": "affected", "version": "10.11", "versionType": "semver"}, {"lessThanOrEqual": "10.15_Fix27", "status": "affected", "version": "10.15", "versionType": "semver"}, {"lessThanOrEqual": "11.1_Fix7", "status": "affected", "version": "11.1", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi&nbsp;endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.</p>"}], "value": "IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi\u00a0endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-03T19:38:30.609Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7261122"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability by applying the following fixes: IBM webMethods API Gateway - 10.11_Fix33 IBM webMethods API Gateway - 10.15_Fix28 IBM webMethods API Gateway - 11.1_Fix8 Above mentioned fixes can be installed using the tool - 'IBM webMethods Update Manager', which is available at: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/eserver/support/fixes/fixcentral\">https://www.ibm.com/eserver/support/fixes/fixcentral</a></p>"}], "value": "IBM strongly recommends addressing the vulnerability by applying the following fixes: IBM webMethods API Gateway - 10.11_Fix33 IBM webMethods API Gateway - 10.15_Fix28 IBM webMethods API Gateway - 11.1_Fix8 Above mentioned fixes can be installed using the tool - 'IBM webMethods Update Manager', which is available at: https://www.ibm.com/eserver/support/fixes/fixcentral"}], "title": "IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:10:59.885017Z", "id": "CVE-2026-2606", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:11:13.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2606", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T21:10:59.885017Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:11:07.613Z"}}], "cna": {"title": "IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11_fix3210.15:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "webMethods API Gateway (on-prem)", "versions": [{"status": "affected", "version": "10.11", "versionType": "semver", "lessThanOrEqual": "10.11_Fix32"}, {"status": "affected", "version": "10.15", "versionType": "semver", "lessThanOrEqual": "10.15_Fix27"}, {"status": "affected", "version": "11.1", "versionType": "semver", "lessThanOrEqual": "11.1_Fix7"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability by applying the following fixes: IBM webMethods API Gateway - 10.11_Fix33 IBM webMethods API Gateway - 10.15_Fix28 IBM webMethods API Gateway - 11.1_Fix8 Above mentioned fixes can be installed using the tool - 'IBM webMethods Update Manager', which is available at: https://www.ibm.com/eserver/support/fixes/fixcentral", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability by applying the following fixes: IBM webMethods API Gateway - 10.11_Fix33 IBM webMethods API Gateway - 10.15_Fix28 IBM webMethods API Gateway - 11.1_Fix8 Above mentioned fixes can be installed using the tool - 'IBM webMethods Update Manager', which is available at: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/eserver/support/fixes/fixcentral\">https://www.ibm.com/eserver/support/fixes/fixcentral</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7261122", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi\u00a0endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi&nbsp;endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-03T19:38:30.609Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2606", "state": "PUBLISHED", "dateUpdated": "2026-03-04T21:11:13.359Z", "dateReserved": "2026-02-16T22:12:35.250Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-03T19:38:30.609Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:webmethods_api_gateway_on_prem:10.11_fix3210.15:*:*:*:*:*:*:*"], "product": "webMethods API Gateway (on-prem)", "vendor": "IBM", "versions": [{"lessThanOrEqual": "10.11_Fix32", "status": "affected", "version": "10.11", "versionType": "semver"}, {"lessThanOrEqual": "10.15_Fix27", "status": "affected", "version": "10.15", "versionType": "semver"}, {"lessThanOrEqual": "11.1_Fix7", "status": "affected", "version": "11.1", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:10.11:-:*:*:on-prem:*:*:*", "matchCriteriaId": "7F534C50-6ADC-4BBC-83E5-973C72964118", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:10.11:fix32:*:*:on-prem:*:*:*", "matchCriteriaId": "2A86D588-0072-4EBE-9FA8-008A36A321D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:10.15:-:*:*:on-prem:*:*:*", "matchCriteriaId": "40E92E62-E820-47B9-BF03-5AF3E32B48D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:10.15:fix27:*:*:on-prem:*:*:*", "matchCriteriaId": "71FCF82E-9B8D-4636-8130-076316E4D35D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:11.1:-:*:*:on-prem:*:*:*", "matchCriteriaId": "978540F2-00C6-4F15-ADB8-32AFF3503460", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:webmethods_api_gateway:11.1:fix7:*:*:on-prem:*:*:*", "matchCriteriaId": "02A837D5-879F-487E-A28F-55DB0C097F00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly validate user-supplied input passed to the url parameter on the /createapi\u00a0endpoint. An attacker can modify this parameter to use a file:// URI schema instead of the expected https:// schema, enabling unauthorized arbitrary file read access on the underlying server file system."}, {"lang": "es", "value": "IBM webMethods API Gateway (en las instalaciones) 10.11 hasta 10.11_Fix3210.15 a 10.15_Fix2711.1 a 11.1_Fix7 IBM webMethods API Management (en las instalaciones) no valida correctamente la entrada proporcionada por el usuario pasada al par\u00e1metro url en el endpoint /createapi. Un atacante puede modificar este par\u00e1metro para usar un esquema URI file:// en lugar del esquema HTTPS:// esperado, lo que permite el acceso de lectura de archivos arbitrario no autorizado en el sistema de archivos del servidor subyacente."}], "id": "CVE-2026-2606", "lastModified": "2026-06-17T10:31:23.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2606", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:10:59.885017Z", "version": "2.0.3"}}]}, "published": "2026-03-03T20:16:49.783", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7261122"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.11,10.11_Fix32]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.15,10.15_Fix27]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.1,11.1_Fix7]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "webMethods API Gateway (on-prem)", "source": "cna", "vendor": "IBM"}, "product": "webmethods_api_gateway_on_prem", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-16T14:00:46.774053+00:00", "value": {"mitigation_remediation": ["Apply IBM\u2019s recommended fixes for WebMethods API Gateway: 10.11_Fix33, 10.15_Fix28, or 11.1_Fix8 using the IBM Update Manager.", "Limit access to the /createapi endpoint to trusted network zones or authenticated users, and configure network segmentation to restrict external exposure.", "Enforce strict validation of URL parameters in the gateway configuration, ensuring that only https:// schemes are accepted and rejecting any file:// or other unsupported schemas."], "summary": {"action": "Apply Patch", "impact": "Unauthorized arbitrary file read"}, "threat_synthesis": {"affected_systems": "IBM WebMethods API Gateway (on\u2011prem) versions 10.11, 10.15, and 11.1 that have not installed the specific vendor\u2011provided fixes: 10.11_Fix33, 10.15_Fix28, and 11.1_Fix8. Any installation of these products without the stated patches is vulnerable.", "description_and_impact": "IBM WebMethods API Gateway fails to validate the URL parameter of the /createapi endpoint, allowing an attacker to supply a file:// URI instead of the expected https:// scheme. This flaw permits reading arbitrary files from the underlying server file system, potentially exposing confidential data, configuration files, or source code. The weakness is a file-path traversal error (CWE-22). The resulting disclosure can compromise system confidentiality.", "risk_and_exploitability": "The vulnerability scores a CVSS 6.5, indicating moderate severity, and has an EPSS score of less than 1%, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. The attack likely requires the attacker to reach the /createapi endpoint, which may be protected by authentication or network segmentation. If the endpoint is reachable and the attacker can craft the URL parameter, they can read any file the server process can access, giving significant potential impact if privilege escalation is feasible."}}}}, "created": "2026-03-04T14:54:07.331679+00:00", "updated": "2026-04-16T14:15:28.798916+00:00", "vendors": ["ibm", "ibm$PRODUCT$webmethods_api_gateway_on_prem"]}