EUVD-2026-78159
GHSA-q6ch-jp7j-7788
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable XXE requiring only an authenticated low-privilege session; high confidentiality from file disclosure, low availability from memory exhaustion, no integrity impact confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
AnalysisAI
XML External Entity injection in IBM Business Automation Workflow allows authenticated remote attackers to read arbitrary server-side files or exhaust memory by submitting crafted XML payloads to processing endpoints. Both containerized (Kubernetes/OpenShift) and traditional on-premises deployments across versions 24.0.0 through 26.0.0 are confirmed affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege access to IBM Business Automation Workflow (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 accurately reflects the combination of network reachability (AV:N), low complexity (AC:L), and high confidentiality impact (C:H) offset by the authentication barrier (PR:L) and absence of integrity impact (I:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released interim fixes for all affected version branches; administrators should apply the corrective interim fix beyond the stated vulnerable ceiling for their installed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM BAW deployments and their current versions across production and non-production environments; implement network-based access controls restricting XML processing endpoints to trusted internal users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today