IBM TRIRIGA EUVD-2026-98085

Exploitation requires an authenticated session on the IBM TRIRIGA Application Platform (versions 5.0.0-5.0.8); the CVSS vector encodes PR:H, indicating the attacker must hold elevated/privileged account access, which is the primary limiting factor. The flaw lies in a platform function that parses attacker-supplied XML with external entity resolution enabled (CWE-611), so a feature that accepts or processes XML input must be reachable by the attacker's account. No victim user interaction is needed (UI:N), and no non-default configuration is cited in the description, but the authentication and privilege requirement substantially limits the realistic attacker population to insiders or those who have already compromised a privileged credential.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.6 (vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) reflects a network-reachable, low-complexity flaw whose severity is driven mainly by the scope change (S:C) and high confidentiality impact (C:H) - consistent with XXE's ability to read files or reach internal resources outside the application's own security authority. The critical mitigating signal is PR:H: the vendor rates this as requiring high privileges, so an attacker must already be an authenticated, likely privileged, TRIRIGA user before the flaw is reachable, which sharply narrows the realistic threat population. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or opportunistic exploitation - exploitation status is 'no public exploit identified at time of analysis.' Note a minor internal tension: the plain-language description says only 'remote authenticated attacker' (implying any authenticated user) while the CVSS vector encodes PR:H (privileged); defenders should verify with IBM which privilege level is actually required, as PR:L would meaningfully raise exposure. Overall: a genuine data-confidentiality concern for internet- or intranet-exposed TRIRIGA instances, but gated behind authentication and lacking any exploitation-in-the-wild signal, so it warrants prompt patching in normal cycles rather than emergency response.

An authenticated TRIRIGA user (per the CVSS vector, one holding elevated privileges) submits a crafted XML document to a platform function that parses XML without disabling external entity resolution. The malicious entity references a local file or internal URL, causing the server to return sensitive data such as configuration files, credentials, or internal network responses. No public exploit code was identified at time of analysis, and the attack requires no user interaction from a victim.