CVE-2026-13449CWE-611

XXE attack in IBM Business Automation Manager Open Editions

High · published June 30, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
33.8
In the wild
Unconfirmed
What it is

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-06-30T19:32Z
EPSS history
Timeline
  • 30 JUN 19:32Z
    XXE attack in IBM Business Automation Manager Open Editions
    cvelistv5