Search
Find a vulnerability
Search criteria
2 vulnerabilities found for business_automation_manager by ibm
CVE-2026-13449 (GCVE-0-2026-13449)
Vulnerability from nvd – Published: 2026-06-30 19:32 – Updated: 2026-07-01 14:30
VLAI
Title
XXE attack in IBM Business Automation Manager Open Editions
Summary
IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7278532 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Business Automation Manager Open Editions |
Affected:
9.0.0 , ≤ 9.4.2
(semver)
cpe:2.3:a:ibm:business_automation_manager_open_editions:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:business_automation_manager_open_editions:9.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T13:50:45.589538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T14:30:07.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:business_automation_manager_open_editions:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:business_automation_manager_open_editions:9.4.2:*:*:*:*:*:*:*"
],
"product": "Business Automation Manager Open Editions",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "9.4.2",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.\u003c/p\u003e"
}
],
"value": "IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T19:32:43.440Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7278532"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Business Automation Manager Open Editions\u003c/td\u003e\u003ctd\u003e9.0.0 - 9.4.2\u003c/td\u003e\u003ctd\u003eUpdate to 9.5.0 using the following instructions \u003ca href=\"https://www.ibm.com/support/pages/node/7277082\" rel=\"nofollow\"\u003eIBM Business Automation Manager Open Editions 9.5 Download Document\u003c/a\u003e\u003cbr/\u003eNote: The reference link is not yet publicly available and will be provided once the GA (General Availability) release is announced.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "Product(s)Version(s) number and/or rangeRemediation/Fix/InstructionsIBM Business Automation Manager Open Editions9.0.0 - 9.4.2Update to 9.5.0 using the following instructions IBM Business Automation Manager Open Editions 9.5 Download Document https://www.ibm.com/support/pages/node/7277082 \nNote: The reference link is not yet publicly available and will be provided once the GA (General Availability) release is announced."
}
],
"title": "XXE attack in IBM Business Automation Manager Open Editions",
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-13449",
"datePublished": "2026-06-30T19:32:43.440Z",
"dateReserved": "2026-06-26T17:12:41.205Z",
"dateUpdated": "2026-07-01T14:30:07.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13449 (GCVE-0-2026-13449)
Vulnerability from cvelistv5 – Published: 2026-06-30 19:32 – Updated: 2026-07-01 14:30
VLAI
Title
XXE attack in IBM Business Automation Manager Open Editions
Summary
IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7278532 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Business Automation Manager Open Editions |
Affected:
9.0.0 , ≤ 9.4.2
(semver)
cpe:2.3:a:ibm:business_automation_manager_open_editions:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:business_automation_manager_open_editions:9.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T13:50:45.589538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T14:30:07.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:business_automation_manager_open_editions:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:business_automation_manager_open_editions:9.4.2:*:*:*:*:*:*:*"
],
"product": "Business Automation Manager Open Editions",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "9.4.2",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.\u003c/p\u003e"
}
],
"value": "IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T19:32:43.440Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7278532"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Business Automation Manager Open Editions\u003c/td\u003e\u003ctd\u003e9.0.0 - 9.4.2\u003c/td\u003e\u003ctd\u003eUpdate to 9.5.0 using the following instructions \u003ca href=\"https://www.ibm.com/support/pages/node/7277082\" rel=\"nofollow\"\u003eIBM Business Automation Manager Open Editions 9.5 Download Document\u003c/a\u003e\u003cbr/\u003eNote: The reference link is not yet publicly available and will be provided once the GA (General Availability) release is announced.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "Product(s)Version(s) number and/or rangeRemediation/Fix/InstructionsIBM Business Automation Manager Open Editions9.0.0 - 9.4.2Update to 9.5.0 using the following instructions IBM Business Automation Manager Open Editions 9.5 Download Document https://www.ibm.com/support/pages/node/7277082 \nNote: The reference link is not yet publicly available and will be provided once the GA (General Availability) release is announced."
}
],
"title": "XXE attack in IBM Business Automation Manager Open Editions",
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-13449",
"datePublished": "2026-06-30T19:32:43.440Z",
"dateReserved": "2026-06-26T17:12:41.205Z",
"dateUpdated": "2026-07-01T14:30:07.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}