IBM has disclosed a high-severity authentication flaw in webMethods Integration Server that lets an already logged-in attacker get around two-factor authentication (2FA) checks. The vulnerability, tracked as CVE-2026-118904, affects the on-premises Integration Server version 12.1, and IBM has released a core fix to close it.

The problem sits in the way the server validates backup codes during 2FA. Backup codes are the one-time codes users fall back on when their usual second factor, such as an authenticator app, is unavailable. IBM says the validation of those codes is improper, so a remote authenticated attacker can bypass security restrictions. The weakness is classified as CWE-287, improper authentication.

IBM rates the flaw 8.1 out of 10 under the CVSS 3.1 scoring system, putting it in the high-severity band. The scoring vector shows the attack can be carried out over the network, needs low complexity, and requires no interaction from a victim. Crucially, though, the attacker must already hold valid credentials: the flaw does not let an anonymous outsider in on its own. Once past the 2FA check, the attacker can reach the confidentiality and integrity of the system at a high level, although the flaw does not directly affect availability.

That combination matters because integration servers often sit at the centre of a business, moving data between applications, partners and cloud services. An account that should have been stopped by a second factor can instead reach systems and data it was never meant to touch. Organisations running webMethods Integration Server 12.1 should therefore treat the patch as urgent, particularly where the server is reachable beyond the internal network.

IBM says there is no workaround. The only remedy is to apply the fix: IS_12.1_Core_Fix1 or a later core fix for the affected version, following the fix readme. Administrators should also review their authentication configuration for bypass weaknesses and tighten access controls while the patch is rolled out, and check whether any accounts show signs of unusual access.

Two-factor authentication is meant to be the second line of defence when a password is stolen or guessed. A weakness in backup-code handling weakens that defence at exactly the point where users are most exposed, because backup codes are often stored, printed or shared more casually than a live authenticator app. That is why IBM's advice is to patch rather than rely on monitoring alone.

The CVE record for the flaw was published on 8 November 2026, although IBM's own security bulletin was first published on 3 November. No public exploit has been reported for this vulnerability, and IBM has not named any attacker or victim. The safest course for affected users is straightforward: install the core fix, confirm the patched version is running, and review login activity for any account that relied on backup codes.