EUVD-2026-78865
GHSA-mrc5-qwcp-hm9c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.
AnalysisAI
IBM Business Automation Workflow, in both its container and traditional (on-premises) distributions, fails to restrict XML external entity resolution when parsing XML data, allowing an authenticated remote user to read server-side files or exhaust process memory. The flaw carries a CVSS base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:N/A:L), meaning a low-privileged but valid account is required — it is not exploitable unauthenticated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
XML External Entity (XXE) injection in IBM Business Automation Workflow containers and traditional deployments allows an
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-mid
Share
External POC / Exploit Code
Leaving vuln.today