What is the CVSS score of EUVD-2026-40389?

EUVD-2026-40389 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Business Automation Manager are affected by EUVD-2026-40389?

IBM Business Automation Manager Open Editions 9.0.0-9.4.2 contains a critical XML injection vulnerability (CVSS 9.1) exploitable by remote unauthenticated attackers to read sensitive files and…

How to fix or mitigate EUVD-2026-40389?

Within 24 hours: Identify all systems running IBM Business Automation Manager 9.0.0-9.4.2 and document network exposure. Restrict external access to XML processing interfaces where operationally feasible; enable verbose application logging. Within 7 days: Deploy WAF rules to detect and block XXE payloads; plan upgrade testing for version 9.5+ pending IBM patch release; communicate risk assessment to business stakeholders. Within 30 days: Establish continuous monitoring for exploitation attempts; contact IBM PSIRT (advisory node 7278532) for patch timeline; execute upgrade to patched version upon release.

Business Automation Manager EUVD-2026-40389

| CVE-2026-13449 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-30 psirt@us.ibm.com

GHSA-v868-4m83-h5w3

IBM XXE Business Automation Manager

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated remote XML submission to a default parser gives AV:N/AC:L/PR:N/UI:N; XXE yields file disclosure (C:H) and memory-exhaustion DoS (A:H) with no integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 18:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 18:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 18:37 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 18:37 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 18:37 NVD

7.6 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 20:36 vuln.today

DescriptionNVD

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

AnalysisAI

XML external entity (XXE) injection in IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 lets a remote, unauthenticated attacker submit crafted XML to the application's XML parser to read sensitive files or exhaust memory. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) but has no public exploit identified at time of analysis, and EPSS is low at 0.39% (31st percentile). Reported by IBM PSIRT with a vendor advisory published (IBM support node 7278532).

Technical ContextAI

IBM Business Automation Manager Open Editions (BAMOE) is IBM's commercial distribution of the open-source KIE/Drools/jBPM decision- and process-automation stack, which routinely ingests XML (BPMN process definitions, DMN decision models, deployment descriptors, and API payloads). The root cause is CWE-611, Improper Restriction of XML External Entity Reference: an underlying XML parser is configured to resolve external entities and DTDs supplied within untrusted XML input. When external entity resolution is enabled, an attacker-controlled entity can point at local files (e.g. file:// URIs) or trigger recursive/large entity expansion, converting normal XML handling into a file-disclosure and resource-exhaustion primitive. The single CPE (cpe:2.3:a:ibm:business_automation_manager:*:*:*:*:open:*:*:*) confirms only the Open Editions variant is in scope.

RemediationAI

Consult the IBM advisory at https://www.ibm.com/support/pages/node/7278532 for the fixed release and upgrade beyond the affected 9.0.0-9.4.2 range; a patch is available per the vendor advisory, though an exact fixed version number is not stated in the available data and should be confirmed directly from IBM before planning the upgrade. As compensating controls until patched: restrict network access to BAMOE XML-processing endpoints (place them behind a reverse proxy/WAF with rules that reject XML containing DOCTYPE/ENTITY declarations), disable DTD processing and external entity resolution at the XML-parser layer if any custom integrations control it, and monitor for outbound requests or large memory spikes triggered by inbound XML. Trade-offs: rejecting DOCTYPE/DTD may break legitimate integrations that rely on DTDs, and WAF filtering can introduce false positives on valid BPMN/DMN uploads, so validate against normal traffic before enforcing.