IBM Business Automation Workflow CVE-2026-1248

Exploitation requires a valid authenticated session with at minimum low-privilege access to the IBM Business Automation Workflow application, as confirmed by the CVSS vector PR:L. The vulnerability is reachable over the network (AV:N) with low attack complexity (AC:L) and requires no user interaction beyond the attacker's own actions. Both containerized and traditional deployment modes are affected - no special non-default configuration is required within those environments. Exploitation is limited by the authentication prerequisite; unauthenticated external actors cannot directly trigger the information leak. The impact is bounded to database structural metadata (schema reconnaissance), not row-level data exfiltration.

The overall risk is moderate-to-low. The CVSS base score of 4.3 reflects limited confidentiality impact (C:L) with no integrity or availability consequence. PR:L confirms that exploitation requires at minimum a valid low-privilege account, meaningfully narrowing the attacker population compared to unauthenticated vulnerabilities. AC:L indicates no special conditions or timing are needed once authenticated. The SSVC framework independently corroborates this posture: Exploitation is rated 'none' (no known exploitation activity), the attack is assessed as not automatable at scale, and technical impact is partial. There is no KEV listing and no public POC. The primary real-world risk is reconnaissance enablement - an attacker who already holds a low-privilege account could use harvested schema details to craft more precise SQL injection payloads or map the data layer for lateral movement. On its own this vulnerability is unlikely to be weaponized independently, but it raises exposure when combined with injection-class weaknesses elsewhere in the application.

An authenticated low-privilege user - such as a business analyst or process participant with a standard application account - submits a malformed or boundary-case workflow request designed to trigger an unhandled database exception. The application returns a verbose error response containing internal database structure details, which the attacker records. No public POC exists at time of analysis, but the attack requires only network access and a valid credential.