IBM Business Automation Workflow CVE-2026-12730

Exploitation requires the attacker to hold high-privilege (administrator-level) credentials on IBM Business Automation Workflow, as confirmed by PR:H in the CVSS:3.1 vector. The attacker must additionally be able to present a TLS server with a certificate that does not match the expected hostname - achievable by controlling an outbound integration endpoint configured within the product, or by performing DNS/routing manipulation for a target host. No user interaction is required (UI:N) once admin access is established. Exploitation is strictly limited by the prior administrative credential compromise requirement; unauthenticated or low-privilege users cannot directly exploit this flaw. Both containerized and traditional deployment modes are affected equally per the vendor description.

The CVSS 3.1 base score of 3.8 (Low) accurately reflects the constrained threat model: the vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N requires high-privilege credentials (PR:H), meaning the attacker must already have compromised administrator-level access before this flaw can be leveraged. While the network attack vector (AV:N) and low complexity (AC:L) suggest no special network positioning is needed at the exploitation stage, the prerequisite credential compromise is a significant barrier. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public proof-of-concept exists, confirming this is not currently under active exploitation. The limited confidentiality (C:L) and integrity (I:L) impacts, scoped to the unchanged system (S:U), further constrain blast radius. This should be treated as a medium-priority patch item in environments where admin credential theft is a realistic threat vector, but does not warrant emergency response absent evidence of active exploitation.

An attacker who has obtained administrator credentials to IBM Business Automation Workflow - through phishing, credential stuffing, or lateral movement - configures or intercepts an outbound workflow integration endpoint to point to an attacker-controlled server presenting a TLS certificate with a mismatched hostname. Because the product does not validate certificate-to-hostname correspondence, the TLS handshake succeeds, and workflow data exchanged over that connection is exposed to interception or manipulation by the attacker-controlled endpoint. No public proof-of-concept code exists at time of analysis.