TIBCO Administrator EUVD-2026-88813

Requires an authenticated account on the TIBCO Administrator web-based administration console (CVSS PR:L confirms low-privilege authentication is needed - this is NOT unauthenticated). The attacker must be able to reach the console over the network (AV:N) and submit crafted input to a vulnerable console field/parameter. Limiting factors: a valid console login is mandatory, so exposure depends on how broadly console access is granted and whether the console is network-restricted; only TIBCO Administrator 5.13.0 and prior are affected. No user interaction by a victim is required (UI:N).

This is a vendor-reported (TIBCO) injection flaw in TIBCO Administrator ≤5.13.0 exploitable through the web-based administration console. The only quantitative signal is the vendor CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L), which indicates a network-reachable, low-complexity attack requiring only low-level authentication (PR:L), yielding high confidentiality/integrity/availability impact on the vulnerable system plus limited subsequent-system impact. There is NO EPSS score, NO CISA KEV listing, and NO public POC referenced, so no public exploit is identified at time of analysis and there is no evidence of active exploitation - the high score reflects potential impact, not demonstrated in-the-wild use. The key tension is that the raw score is high (8.7) but real-world exploitation signals are entirely absent, so this is a genuine 'patch promptly if deployed' issue rather than an emergency: it requires an authenticated foothold (a valid Administrator console account), which meaningfully limits the attacker population. Note the vector maps VC/VI/VA:H, consistent with the 'Code Injection' tag implying command/code execution as the console service, but no CWE was assigned and the specific injection class (OS command, expression/EL, etc.) is not disclosed - verify with the TIBCO advisory before assuming a particular exploitation technique.

An attacker who has obtained low-privilege credentials to the TIBCO Administrator web console (via phishing, credential reuse, or an insider) submits specially crafted input to a console field or parameter, causing the server to execute injected code/commands in the context of the Administrator service. No public POC or exploit code is referenced, so exploitation would currently require independent development, though the low attack complexity (AC:L) suggests it is not difficult once console access is held.