Business Automation Workflow EUVD-2026-78082

Exploitation requires a valid authenticated session to the IBM BAW authoring or runtime environment (CVSS PR:L), which is typically held by developers, process authors, and integration administrators. The vulnerable condition is enabled by default - no special configuration or non-default feature flag is needed; simply deploying a standard BAW installation on any affected version places the XXE-vulnerable XML parsers in the processing path of programming model artifacts. Exploitation is limited by the authentication barrier (unauthenticated external attackers cannot exploit this directly), the need to interact with the artifact submission or processing interface, and network-level controls that may restrict outbound connections from the server. Both container and traditional deployment models are affected equally.

The CVSS 3.1 score of 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L characterizes this as a network-reachable, low-complexity flaw requiring only authenticated (low-privilege) access. The Confidentiality:High rating reflects XXE's well-established ability to exfiltrate local file content (e.g., /etc/passwd, application config with credentials) and perform SSRF to internal services. Availability:Low captures the possibility of resource exhaustion via recursive entity expansion. No Integrity impact aligns with classic read-only XXE behavior. The 'by default' language in the description is a meaningful risk amplifier - the vulnerable condition requires no special misconfiguration, only normal use of the platform's programming model. No KEV listing, no POC, and no EPSS data are available, so real-world exploitation probability cannot be quantified beyond CVSS. The requirement for PR:L (authenticated access) materially reduces the attack surface compared to PR:N flaws, but IBM BAW is an integration platform often accessible to a broad internal user population including developers and process authors.

An authenticated BAW developer or process author with access to the workflow authoring environment submits a crafted XML programming model artifact containing a malicious external entity declaration pointing to a sensitive server-side file such as a credential configuration or an internal metadata endpoint. The BAW XML parser resolves the entity, and the file content or HTTP response is reflected back in a parser error message, API response, or log entry that the attacker can retrieve. No public exploit code exists, but standard XXE tooling (e.g., Burp Suite's XXE scanner) would trivially exercise this path once authenticated access is obtained.