Activematrix Businessworks CVE-2026-3912

Requires authenticated access to TIBCO ActiveMatrix BusinessWorks or Enterprise Administrator. Attacker must be a logged-in user with network access to the application. No victim interaction needed. Affects versions vulnerable to input validation bypass in injection handlers.

Without a CVSS vector or EPSS score, the risk assessment must rely on vulnerability class analysis and reported impact. The stated impact of information disclosure (local file access, system details) and application manipulation indicates at minimum a moderate-to-high severity vulnerability. Injection vulnerabilities historically demonstrate high exploitability in real-world conditions, particularly when affecting widely-deployed enterprise platforms like TIBCO's products. The absence of a published CVSS score suggests either recent disclosure or vendor embargoes; however, the rapid issuance of a security advisory by TIBCO in March 2026 indicates the vendor treats this as actionable and remediable. The attack vector is likely network-based (given these are enterprise web/API platforms), and no public proof-of-concept or active exploitation (KEV status) has been reported at the time of advisory. Organizations running affected versions should prioritize patching given the information disclosure risk and potential for lateral movement or configuration tampering through application behavior manipulation.

An attacker with network access to a vulnerable TIBCO Enterprise Administrator or ActiveMatrix BusinessWorks instance could craft malicious input containing injection payloads (e.g., script tags, command sequences, or expression language) and submit them via web forms, API parameters, or configuration endpoints. The insufficient input validation would allow the payload to bypass sanitization filters and be processed by the backend, resulting in local file disclosure (e.g., reading configuration files containing credentials or system details) or alteration of application behavior such as redirecting workflows or disabling security controls. No public proof-of-concept has been reported, but the injection class of vulnerabilities typically requires moderate attacker sophistication and is generally feasible given network access to the web interface.