Back to overview

CVE-2026-13449

HIGH
7.6
CVSS 3.1
Description
IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Metadata

CVE ID
CVE-2026-13449
State
PUBLISHED
Assigner
ibm
Reserved
2026-06-26 17:12 UTC
Published
2026-06-30 19:32 UTC
Last updated
2026-06-30 19:32 UTC
Primary CWE
CWE-611
CWE-611 Improper Restriction of XML External Entity Referenc…
Vendor / Product
IBM / Business Automation Manager Open Editions
Sources
cve.org  ·  NVD

Severity & Metrics

7.6 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Affected products (1)
VendorProductPlatformVersions
IBM Business Automation Manager Open Editions — 9.0.0 ≤ 9.4.2
Weakness (CWE)
CWESourceDescription
CWE-611 cna CWE-611 Improper Restriction of XML External Entity Reference
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.6 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
References (1)
Back to overview