The vulnerability originates from the deserialization of untrusted data within the WmServiceMock package of IBM webMethods Integration on prem. An unauthenticated attacker could supply malicious serialized objects that, when deserialized by the package, lead to arbitrary code execution on the host system. This flaw exposes both confidentiality and integrity of the system, enabling a full compromise if successfully exploited.

IBM webMethods Integration on prem, versions 10.15.0, 10.15, and 10.11, specifically the WmServiceMock package. The package is intended solely for development and testing environments and is not designed for use in production deployments.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of 0.00499 (< 1%) suggests a very low yet nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, unauthenticated, and relies on the package's deserialization logic. If the package is exposed to an internet-facing network, the risk of exploitation becomes high and could result in full system compromise. In a production setting, the best practice is to remove the package entirely, as no patch is available and exploitation would otherwise be possible.