IBM Business Automation Workflow EUVD-2026-78159

Exploitation requires a valid authenticated session with at least low-privilege access to IBM Business Automation Workflow (confirmed by CVSS PR:L). The attacker must be able to reach a BAW XML data-processing endpoint over the network (AV:N, AC:L). No special non-default configuration or feature flag is indicated as required - the vulnerability exists in core XML processing present in both containerized and traditional deployments. What limits exploitation: an authenticated credential is required and cannot be bypassed (PR:L rules out unauthenticated attack paths); scope is unchanged (S:U), so the vulnerability alone does not permit direct pivot to adjacent systems; and there is no integrity impact, meaning the attacker can read but not modify data through this vector.

The CVSS 3.1 base score of 7.1 accurately reflects the combination of network reachability (AV:N), low complexity (AC:L), and high confidentiality impact (C:H) offset by the authentication barrier (PR:L) and absence of integrity impact (I:N). The low availability impact (A:L) captures memory exhaustion via entity expansion rather than a full denial-of-service. EPSS data was not provided in available intelligence, preventing probabilistic exploitation forecasting. No CISA KEV entry exists, and no public proof-of-concept code has been identified, placing this firmly in the 'no public exploit identified at time of analysis' category. Despite these mitigating signals, XXE vulnerabilities in enterprise middleware carry disproportionate real-world risk because they reliably disclose credential files, certificates, and internal configuration that facilitate lateral movement - even a mid-sized municipal IT team in mielec operating BAW for administrative workflow automation should treat this as urgent given the high confidentiality ceiling. The PR:L requirement is the primary friction point: any valid BAW user account, including service accounts created for integrations, satisfies it.

An attacker holding any valid low-privilege BAW user account - such as a shared service account credential obtained through phishing or credential reuse - crafts an XML payload embedding a DOCTYPE declaration with an external entity referencing a sensitive local file path such as file:///opt/ibm/BAW/wlp/usr/servers/defaultServer/server.xml. Submitting this payload to a BAW XML-processing endpoint causes the parser to resolve and inline the file contents, returning database credentials or keystore passwords in the application response. No public proof-of-concept code is known to exist.