IBM products hit by unauthenticated takeover flaws: webMethods, HMC, App Connect, Langflow in late July

Unauthenticated takeover flaws keep hitting IBM products — late July spreads to webMethods, HMC, App Connect, and Langflow

On July 30, 2026, IBM disclosed a set of critical flaws across several flagship products that let an attacker take over a server with no login credentials. Three of them are the most dangerous, each carrying a CVSS base score of 9.8 (Critical): remote code execution via unsafe deserialization in the data-integration platform webMethods Integration (CVE-2026-12118), unauthenticated privileged command execution in the Hardware Management Console (HMC) that manages IBM Power servers (CVE-2026-12943), and a path-traversal flaw in the other integration platform, App Connect Enterprise, that lets a remote attacker write arbitrary files (CVE-2026-15435). All three trigger simply by sending a crafted request.

In the same window, Langflow — the open-source AI development tool now owned by IBM — picked up three more critical flaws: two at CVSS 9.9 (code injection = CVE-2026-12946 and a PythonREPL sandbox escape = CVE-2026-13435) and one at CVSS 9.8 (unauthenticated takeover via the MCP integration mechanism = CVE-2026-12940). Langflow had an unauthenticated takeover flaw (CVE-2026-10561) as recently as June 2026, so the holes keep coming. There is also a cross-site scripting flaw in the admin console of the operations product Tivoli System Automation Application Manager (CVE-2026-11707, CVSS 9.3).

This is a continuously updated roundup of the critical IBM vulnerabilities disclosed since May 2026. The top-priority items come first: we cover the late-July unauthenticated takeover wave at the depth of a standalone article, then the remote code execution wave in WebSphere Application Server from May–June, then the early-July admin-console XSS, each with a quick-reference table of affected versions and fixes.

As of July 31, 2026, we have not confirmed any listing of the late-July items on the CISA Known Exploited Vulnerabilities catalog, nor any public proof-of-concept code. Given that all of them are reachable without authentication (or with only low privilege), and that deserialization and command-execution types have been exploited repeatedly in the past, read the urgency as patch within one to two weeks. For a cross-vendor view of the major enterprise-product vulnerabilities affecting organizations in Japan, see our 2026 Japan enterprise vulnerability roundup. In the same business-server space, Oracle WebLogic has a flaw already exploited in the wild — CVE-2024-21182 was added to CISA's KEV.

Before this late-July wave, IBM had already been publishing critical flaws in successive rounds, mainly in the WebSphere family: the unauthenticated WebSphere remote code execution (CVE-2026-8633, CVSS 9.8), the authorization bypass in Engineering Lifecycle Management (ELM, CVE-2026-3660, CVSS 9.8), the four WebSphere additions of June 1, and the early-July admin-console XSS. Those are covered in detail later in this article, alongside the IBM security bulletin list.

Late-July 2026 additions: multiple unauthenticated takeovers in webMethods, HMC, App Connect, and Langflow

The flaws IBM disclosed on July 30, 2026 span a different product group than WebSphere: integration platforms, a management console, and an AI development tool. What they share with the earlier WebSphere wave is a near-worst-case property: someone with no login credentials can reach them directly over the network. Here's the list first.

Who actually comes after this late-July batch

These holes line up dangerously because the targets are the data flowing between companies, or the console that controls a whole fleet of servers. The buyers are ransomware crews that encrypt order and payment data and demand a ransom, "initial access brokers" who find a way in and resell it to other attackers, and industrial spies after inter-company trade information and design data. webMethods and App Connect are hubs that connect internal systems to trading partners, payments, and inventory; break in there and orders, invoices, stock, and customers' personal data can be pulled out from a single point, or fake integration data can be pushed in. HMC is worse still: it is the console that creates, stops, and deletes the many virtual servers running on IBM Power, so if unauthenticated privileged commands get through, the entire platform is under control.

The damage does not stop at one company. Seize an integration platform and bad data flows out to trading partners, halting payments and logistics. The cleanup falls on the IT department and management; a personal-data breach brings reporting duties, customer and partner notifications, damages, and lost trust. A path where an unauthenticated hole lets ransomware shut down operations is not hypothetical — from 2025 into 2026, the ransomware attack on Asahi Group halted factories and logistics for a long stretch, all from allowing a single entry point.

CVE-2026-12118: webMethods Integration taken over without authentication (CVSS 9.8)

The top-priority item is CVE-2026-12118. IBM webMethods Integration is a data-integration platform (integration middleware) that connects internal and external systems, and order, inventory, and payment data pass through it. The affected versions are the on-premises 10.11 and 10.15. The classification is CWE-502 (deserialization of untrusted data): tamper with the step that rebuilds incoming data into its original form, and commands hidden in the data run as-is on the server. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no login, no user interaction — about as close to a worst case as it gets. The fix ships as the Interim Fix / Fix Pack described in IBM's security bulletin, so organizations running these versions should check first.

CVE-2026-12943: HMC runs privileged commands without authentication (CVSS 9.8)

CVE-2026-12943 is a flaw in the Hardware Management Console (HMC) that centrally manages IBM Power servers. The HMC is the "console" from which you create, start, stop, and delete the many virtual servers built on the physical hardware. The classification is CWE-78 (OS command injection): because user-supplied input is validated poorly, an unauthenticated attacker can run arbitrary commands at high privilege just by sending crafted input. CVSS is 9.8. Affected are HMC V10.3 (1050.0–1064.0) and V11.1 (1110.0–1112.0). Seize the console and the entire fleet of business servers underneath can be controlled, so apply the fix from IBM's bulletin quickly. HMC is a device you should never expose to the internet, but it is a prime pivot target after an attacker gets into the management network.

CVE-2026-15435: remote arbitrary file write in App Connect Enterprise (CVSS 9.8)

CVE-2026-15435 is a flaw in the other integration platform, App Connect Enterprise. The classification is CWE-22 (path traversal): mix a "go up one level" sequence into a path string to reach places that should be off-limits. Per IBM, an attacker can write files to arbitrary locations on the server without authentication just by sending a URL containing directory-traversal sequences. Plant a malicious file where it will be executed, and it escalates to takeover. The CVSS vector is the same as webMethods: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected are 12.0.1.0–12.0.12.27 and 13.0.1.0–13.0.7.2, and the fix ships as the iFix described in IBM's bulletin.

Three in Langflow (the IBM-owned OSS): code execution, sandbox escape, MCP takeover

Langflow is a popular open-source tool for building AI agents by wiring components together on a canvas. It was originally developed by DataStax, but it is now owned by IBM and treated as "IBM Langflow OSS," and NVD catalogs it as an IBM product. Three critical flaws landed on it at once in late July. All are CWE-94 (improper code execution) or CWE-78 (OS command execution), and success means server takeover.

CVE-2026-12946 (CVSS 9.9) is code injection: user-supplied code is handled loosely, letting an attacker inject arbitrary code. Affected: 1.0.0–1.10.0. CVE-2026-13435 (CVSS 9.9) is a sandbox escape: the input validation in the "PythonREPL sandbox," which is supposed to confine and run Python code, has a hole that lets code break out of isolation and run on the host. Affected: 1.0.0–1.10.1. Both carry the CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, meaning exploitation requires a low-privilege login (PR:L). Note that on validation instances left open to login, or installs widely shared internally, that precondition is easily met.

The most dangerous of the three, being unauthenticated (PR:N), is CVE-2026-12940 (CVSS 9.8). The startup path (stdio launcher) of MCP (Model Context Protocol), the mechanism that connects AI to external tools, has an environment-variable injection hole. The blocklist for dangerous environment variables omitted SHELLOPTS / BASHOPTS / PS4, and abusing those lets an attacker run code on the server without authentication. Affected: 1.0.0–1.10.1. All three are resolved by updating to the fixed latest release (the 1.11 line). A Langflow left exposed on the internet is especially dangerous, and validation instances are the most likely to be targeted, so check any install reachable from outside right now.

CVE-2026-11707: admin-console XSS in Tivoli System Automation Application Manager (CVSS 9.3)

The operations/automation product Tivoli System Automation Application Manager 4.1 has cross-site scripting (XSS, CVE-2026-11707) on the login page of its admin console. XSS embeds a crafted string into a page so the attacker's script runs in the browser of whoever opens it. The classification is CWE-79, and the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N: no login required, but an administrator must open the attacker's link (UI:R). It is a notch milder than the unauthenticated RCE above, but if a console operator takes the bait, actions can be hijacked under their privileges. The fix is the update described in IBM's bulletin, plus keeping the console off the internet and off wide internal networks.

For priority, read it as: first the four that allow unauthenticated server takeover (CVE-2026-12118 / 12943 / 15435 / 12940) this week, then the two Langflow 9.9 items that need low privilege, and finally the Tivoli XSS that requires admin interaction. For the rollout approach, see "The reality of applying an Interim Fix" below.

Early-July 2026 additions: three admin-console XSS flaws and a Liberty SSRF (CVE-2026-11708 and others)

The four flaws IBM disclosed on June 30 – July 1, 2026 are all in the WebSphere family, but they differ in kind from the earlier remote code execution. Three are cross-site scripting (XSS) in the administrative console — they need a user, typically an administrator, to be lured into a crafted link — and one is an SSRF in Liberty. Here's the list first.

CVE-2026-11708 / CVE-2026-11712 (CVSS 9.3): admin-console XSS

Both are cross-site scripting (XSS, CWE-79) in the help system of the WebSphere Application Server admin console (8.5 and 9.0). XSS embeds a crafted string into a page so that the attacker's script runs in the browser of whoever opens it. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N: no login is required (PR:N), but it needs an administrator to open the attacker's link (UI:R). If a console operator takes the bait, actions on the console can be hijacked under their privileges. The 9.3 score reflects that the impact spreads beyond the console itself (S:C).

CVE-2026-11594 (CVSS 8.5): admin-console XSS (adjacent network)

Also an admin-console XSS, but the attacker must be on an adjacent network (AV:A, e.g. the same LAN), which lowers the score to 8.5 (CVE-2026-11594). It affects the same WebSphere AS 8.5 and 9.0 branches. The narrower reach reduces the risk, but it still warrants attention where the console is open on the internal network.

CVE-2026-11714 (CVSS 8.5): Liberty SSRF (needs login, apiDiscovery enabled)

One of the four is a different beast. CVE-2026-11714 is a server-side request forgery (SSRF, CWE-918) in WebSphere Liberty (17.0.0.3–26.0.0.7). SSRF uses the server as a stepping stone to reach internal resources that shouldn't be reachable from outside. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N: exploitation requires a login (low privilege, PR:L) and only applies when the apiDiscovery-1.0 feature is enabled. If you don't use it, disabling that feature is an effective mitigation.

The fix for all four is IBM's Interim Fix or the latest fix pack. Config-side steps help too: don't expose the admin console to the internet or a wide internal network (narrowing the entry point for the three XSS flaws), and disable apiDiscovery if you don't use it (removing the precondition for the SSRF). See "The reality of applying an Interim Fix" below for the rollout approach. As of this article, we have not confirmed any CISA KEV listing or in-the-wild exploitation for these four.

The buyers lining up for the platforms that sit on ledgers and blueprints

This section is the attacker profile for the WebSphere / ELM flaws covered later. What makes the WebSphere flaw dangerous is that someone with no login at all can reach the server directly over the internet. The people willing to pay for this hole are ransomware crews that encrypt core banking systems and demand a ransom, "initial access brokers" who find a way in and sell it to other attackers, and state-backed hackers after design data in automotive, semiconductors, defense, and aerospace.

What they want to carry off is banks' transaction records, unreleased earnings, aircraft and automotive blueprints, and medical-device certification dossiers. Both CVE-2026-8633 and CVE-2026-3660 are reachable without authentication, so once exploited, the whole server is taken over and that data flows straight out. A broker who finds the way in resells the route to ransomware leaders for a few thousand to tens of thousands of dollars per case, and the buyer encrypts the data to halt operations, then doubles the pressure with "pay up or we publish what we stole."

If attackers seize ELM (the platform that centrally manages product design data) that ties together the designs of finished vehicles, aircraft, and medical devices, the damage does not stop at one company—it spreads to parts suppliers and the hospitals that deploy those devices. The cleanup falls on the IT department and management: a breach brings reporting and customer-notification duties, explanations to business partners, damages, and lost trust. Whether you can close these holes before decades of accumulated blueprints, transaction history, and customer trust are pulled out in one motion is what decides the outcome.

A path where an unauthenticated hole lets ransomware shut down operations is not hypothetical. From 2025 into 2026, the ransomware attack on Asahi Group halted factories and logistics for a long stretch and even dented revenue—all from allowing a single entry point. Because WebSphere sits at the foundation of so many core systems, it is worth acting before the same thing happens.

Quick reference: product version × fix × patch priority

Below is a map of the main items by product version, fix, and patch priority, ordered roughly by how likely enterprise IT teams are to be running the affected component. The top rows are the newest (late-July) unauthenticated takeover wave.

The late-July top rows carry a different risk color than the May–June WebSphere items. The following sections work through the June WebSphere flaws in priority order.

The May–June WebSphere flaws, per CVE

This section covers the WebSphere family and related products disclosed before the late-July wave. The most severe is the AI development tool flaw disclosed on June 22. Before the WebSphere enterprise stack, we take that one first.

CVE-2026-10561: AI development tool Langflow taken over without authentication (CVSS 10.0)

The IBM-owned open-source tool Langflow has an unauthenticated remote code execution (CVE-2026-10561), scoring the maximum CVSS 10.0. Langflow is a popular tool for building AI agents by wiring components on a canvas; affected versions are 1.0.0–1.9.3, fixed in 1.9.4. On an install exposed to the internet, the server can be taken over with no ID or password. Langflow has repeatedly carried flaws of this kind, some exploited soon after disclosure. As noted above, three more (CVE-2026-12940 / 12946 / 13435) were added in late July, so if you run Langflow, make updating to the latest release a habit. The user base differs from core systems like WebSphere, but a Langflow spun up for testing and left publicly exposed is especially dangerous. Note that on the same June 22 date, another critical flaw from an MCP authorization gap (CVE-2026-7664, CVSS 9.8) was disclosed; updating to 1.9.4 resolves both. The mechanism, scope, and concrete mitigations are covered in detail in the dedicated article.

Now the enterprise mainstay, WebSphere. We start with the four flaws disclosed on June 1, 2026. All affect the 8.5 and 9.0 branches, and the fix for each ships as an Interim Fix plus Fix Pack (roughly 9.0.5.28 / 8.5.5.30 or later as a guide). The per-CVE APAR numbers are listed in IBM's security bulletin list; we avoid stating exact numbers here so as not to point you to the wrong build.

CVE-2026-8644: authentication bypassed by spoofing (CVSS 9.1)

The most severe of the June batch, CVE-2026-8644, is classified as CWE-290 (authentication bypass by spoofing). Functions meant only for logged-in users can be reached by an attacker impersonating someone else. If reachable over the network, no prior login or user action is required — like walking in by holding up someone else's badge rather than breaking the front lock.

CVE-2026-9311: crafted input runs commands on the server (CVSS 9.0)

CVE-2026-9311 is remote code execution via CWE-94 (code injection). Exploiting a weakness that bypasses a security control lets an attacker's commands run directly on the server. NVD rates the attack complexity as somewhat high (AC:H), but no login or user action is required, and success means server takeover.

CVE-2026-9319: takeover via abused deserialization (CVSS 9.0)

CVE-2026-9319 is CWE-502 (unsafe deserialization of untrusted data). Tamper with the step that rebuilds incoming data into its original form, and commands hidden in the data run as-is. Here the entry point is a JAX-WS mechanism using the WS-Security standard. WebSphere has repeatedly carried this deserialization type, making it a familiar target for attackers.

CVE-2026-9330: takeover via SAML single sign-on (CVSS 8.5)

CVE-2026-9330 is the same deserialization type, but the entry point is the SAML single sign-on (SSO) processing. An attacker holding a low-privilege account could send a crafted request and run commands on the server. Requiring some privilege keeps the severity at 8.5, but it is more than enough for lateral movement once an attacker has an internal foothold. Check your configuration if you use SAML SSO.

CVE-2026-8633: WebSphere Application Server taken over without authentication (CVSS 9.8)

The most severe item in the June batch is CVE-2026-8633. Per IBM's security bulletin, the Web Server Plug-ins component (the part that integrates with the web server) shipped with WebSphere Application Server (traditional) and Liberty contains a flaw that lets a single crafted request execute arbitrary code on the server. The classification is CWE-94 (improper control of generation of code), and the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no login, no user interaction. About as close to a worst case as it gets.

Affected are the 8.5 and 9.0 branches of WebSphere Application Server, plus Liberty deployments that pair with Web Server Plug-ins. WebSphere is widely used as a Java business-app platform in large Japanese banks' core systems, retail backbones, manufacturing MES, and government core systems. The 8.5 branch, released in 2014, is still in production at many organizations on extended support — exactly the "running, do not touch" assets this bug targets. The fix ships as an Interim Fix or Fix Pack containing APAR PH71342. If you cannot patch for now, adding WAF (web-defense appliance) rules that block the malicious request at the perimeter is the realistic mitigation.

CVE-2026-3660: authorization bypass in Engineering Lifecycle Management (CVSS 9.8)

Published the same day, CVE-2026-3660 is an unauthenticated authorization bypass in ELM. CVSS 9.8, classification CWE-863 (incorrect authorization). Per IBM's bulletin, a remote third party with no credentials can rewrite the server's configuration files and reach areas that should require authorization.

ELM is IBM's management suite for large-scale system development, bundling requirements management (DOORS Next), test management, and work/project management. It is heavily used in regulated software development (automotive, aerospace, defense, medical devices) and is deployed at large Japanese automotive OEMs, aerospace and defense suppliers, and medical device makers. Affected are 7.0.3 / 7.1.0 / 7.2.0, with per-version Interim Fixes already published. ELM is usually run inside the corporate network, so direct external attack is less likely than for WebSphere, but it is a repository where the intellectual property of the entire product lifecycle — design data, requirements, test cases — is concentrated, and a prime pivot target after a foothold. Applying the fix within the current quarter is essential.

CVE-2026-8620: HTTP request smuggling in WebSphere (CVSS 7.5)

CVE-2026-8620 is an "HTTP request smuggling" flaw in the same Web Server Plug-ins as CVE-2026-8633. An attacker slips a malicious request into legitimate traffic to bypass defenses. CVSS is 7.5, and the fix is included in the same APAR PH71342 as 8633. Applying the 8633 patch resolves it too, so always apply them together.

CVE-2026-1561: WebSphere Liberty internal request forgery (SSRF)

A flaw in how Liberty forwards a received request to another internal destination lets an attacker indirectly send requests to resources behind the server (SSRF). The fix is planned in Liberty Fix Pack 26.0.0.4 or later. Managed services run by cloud providers update automatically; self-managed Liberty deployments wait for the Fix Pack.

CVE-2026-32776 / 32777 / 32778: IBM HTTP Server libexpat trio

Three flaws inherited from the XML-parsing library libexpat used inside IBM HTTP Server. Not direct takeover, but if you expose XML-heavy traffic via WebSphere, they can lead to service outage, so update IBM HTTP Server to the latest version.

CVE-2026-29063: prototype pollution in the immutable library

Prototype pollution (an object's internal settings can be rewritten maliciously) from the JavaScript immutable library bundled with Liberty. Impact is limited for the majority of users who do not run JavaScript code paths on Liberty, but affected organizations are in scope.

CVE-2026-1726: privilege escalation in Guardium Key Lifecycle Manager

Guardium Key Lifecycle Manager (GKLM, formerly Tivoli Key Lifecycle Manager) is a critical component for storage-encryption key management; affected are versions 4.1–5.1. Authentication is required, so it's not a direct external one-shot, but post-foothold lateral movement to the key-management plane neutralizes every encrypted asset. A security-foundation item that cannot be dismissed.

Author's view: how to actually rank these in the enterprise

This section is the author's view on how Japanese enterprise IT teams should rank these. The late-July unauthenticated takeover wave (webMethods / HMC / App Connect / Langflow MCP) is all reachable without authentication, so even at the same CVSS 9.8 it belongs in the top immediate lane, level with the WebSphere items. Externally facing integration platforms and any externally reachable Langflow install are "this week" work.

Next comes the May–June WebSphere set. By CVSS, the WebSphere RCE and the ELM bypass tie at 9.8, but in practice they should not be treated as the same priority. First, the WebSphere RCE (CVE-2026-8633). The answer depends on whether you have any WebSphere reachable from the public internet. If yes, this is a "patch this week" item. Even for fully internal deployments, lateral movement through a compromised endpoint makes two weeks the realistic outer limit. The same patch (APAR PH71342) also closes CVE-2026-8620.

Second, the ELM authorization bypass (CVE-2026-3660). ELM is almost always internal, so direct attack surface is lower than WebSphere. But what it holds — requirements, designs, test cases — is intellectual property for regulated-development organizations, so land the fix within the current quarter (up to ~3 months) without fail.

Third, the mid-severity SSRF / libexpat / immutable items and the admin-interaction XSS group (the three early-July WebSphere flaws and Tivoli's CVE-2026-11707). WAF rules, network segmentation, and limiting admin-console exposure buy time while you wait for Fix Packs. The standard patch cycle is enough. In other words, a blanket "treat every CVSS 9.0+ identically" policy hurts here. Concentrate immediate patching on the unauthenticated takeover group and schedule the interaction/privilege-gated items — that gradient is the realistic answer.

Author's view: why IBM clusters vulnerability disclosures like this

IBM tends to publish security bulletins in waves clustered around May, August, November, and February. The late-July burst across webMethods, HMC, App Connect, and Langflow reads as an early push toward the August window. From the author's view, two structural reasons explain the pattern.

First, the Oracle Java Critical Patch Update quarterly cycle. WebSphere and ELM both carry an IBM Java runtime, so IBM's update schedule rides Oracle's quarterly CPU. The April Oracle CPU produces the late-May IBM responses we're looking at now.

Second, IBM enterprise products bundle a large number of OSS components. WebSphere alone contains a Java runtime, libexpat, assorted JavaScript libraries, and XML parsers from upstream, and every upstream CVE triggers an "evaluate impact in the IBM product, publish a bulletin" loop. On top of that, OSS that IBM has acquired — such as Langflow — enters this re-evaluation loop as an "IBM product," pushing the count up with each release. So organizations running IBM stacks should restructure patch management from "reflexive per-CVE response" to "quarterly batched response," with a fast lane reserved for the rare unauthenticated CVSS 9.8 exception.

The reality of applying an Interim Fix: the production checklist

This is a roundup, not a patch runbook, so we leave the details to IBM's docs — but here is the minimum production checklist. It is broadly common to WebSphere, ELM, webMethods, and App Connect.

• Download the version-specific Interim Fix from IBM Fix Central
• Apply the same Fix in a pre-production environment (DEV/STG) and run regression tests
• Production apply in a scheduled maintenance window, one node at a time, draining each on the load balancer
• Verify the Fix number after applying, using the version display equivalent to versionInfo.sh (WebSphere)
• Keep a rollback plan: a pre-apply snapshot of the binaries and configuration

For OSS you run directly, such as Langflow, you update to the latest release from package management (pip, etc.) or the official release rather than Fix Central. The most common gotcha for Japanese enterprises specifically: like WebSphere 8.5, without an extended-support (Continuous Delivery) contract, Interim Fixes are not delivered at all. If you are still on an old version, start by checking your IBM contract status.

FAQ

Change log

References

• ・NVD — CVE-2026-12118 (webMethods Integration deserialization RCE, CVSS 9.8, July 30)
• ・IBM Security Bulletin — CVE-2026-12118 (webMethods Integration)
• ・NVD — CVE-2026-12943 (HMC OS command injection, CVSS 9.8, July 30)
• ・IBM Security Bulletin — CVE-2026-12943 (Hardware Management Console)
• ・NVD — CVE-2026-15435 (App Connect Enterprise path traversal, CVSS 9.8, July 30)
• ・IBM Security Bulletin — CVE-2026-15435 (App Connect Enterprise)
• ・NVD — CVE-2026-12946 (Langflow OSS code injection, CVSS 9.9, low priv.)
• ・NVD — CVE-2026-13435 (Langflow OSS PythonREPL sandbox escape, CVSS 9.9, low priv.)
• ・NVD — CVE-2026-12940 (Langflow OSS MCP env-var injection, CVSS 9.8, no auth)
• ・IBM Security Bulletin — CVE-2026-12946 (Langflow OSS)
• ・NVD — CVE-2026-11707 (Tivoli System Automation Application Manager admin-console XSS, CVSS 9.3)
• ・IBM Security Bulletin — CVE-2026-11707 (Tivoli SA Application Manager)
• ・NVD — CVE-2026-10561 (Langflow unauthenticated RCE, CVSS 10.0, June 22)
• ・NVD — CVE-2026-11708 (WebSphere AS admin-console XSS, CVSS 9.3, Jun 30 – Jul 1)
• ・NVD — CVE-2026-11712 (WebSphere AS admin-console XSS, CVSS 9.3)
• ・NVD — CVE-2026-11594 (WebSphere AS admin-console XSS, adjacent, CVSS 8.5)
• ・NVD — CVE-2026-11714 (WebSphere Liberty SSRF, login + apiDiscovery, CVSS 8.5)
• ・NVD — CVE-2026-8644 (WebSphere AS auth bypass, June 1)
• ・NVD — CVE-2026-9311 (WebSphere AS code-injection RCE, June 1)
• ・NVD — CVE-2026-9319 (WebSphere AS deserialization RCE, June 1)
• ・NVD — CVE-2026-9330 (WebSphere AS SAML SSO deserialization RCE, June 1)
• ・Related — Oracle WebLogic CVE-2024-21182 exploited in the wild (CISA KEV)
• ・Related — Langflow CVE-2026-10561 in-depth
• ・NVD — CVE-2026-8633 (WebSphere AS Web Server Plug-ins RCE)
• ・NVD — CVE-2026-3660 (Engineering Lifecycle Management authorization bypass)
• ・NVD — CVE-2026-8620 (Web Server Plug-ins HTTP request smuggling)
• ・IBM Security Bulletin — CVE-2026-8633 / CVE-2026-8620 (APAR PH71342)
• ・IBM Security Bulletin — CVE-2026-3660
• ・IBM Security Bulletin — CVE-2026-1561 (Liberty SSRF)
• ・IBM Security Bulletin — IBM HTTP Server libexpat trio
• ・WebSphere Application Server and IBM HTTP Server Security Bulletin List
• ・CVE-2026-1726: IBM Guardium Key Lifecycle Manager Flaw
• ・CISA Known Exploited Vulnerabilities Catalog
• ・CWE-94: Improper Control of Generation of Code
• ・CWE-502: Deserialization of Untrusted Data
• ・CWE-78: OS Command Injection
• ・CWE-22: Path Traversal