CVE-2026-12742
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IBM Business Automation Workflow (containers and traditional) lacks authorization controls, allowing an authenticated attacker to trigger restricted import actions. The flaw stems from insufficient enforcement of permissions on import operations.
Risk Assessment
An authenticated low-privileged user could perform import operations they should not be allowed to, potentially leading to unauthorized modification of data or system configuration.
Recommendation
Apply the available IBM fixes for IBM Business Automation Workflow as soon as possible and review/enforce authorization controls for import actions.
Other vulnerabilities in IBM Business Automation Workflow
See all- CVE-2026-12752High
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-12756High
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-13107High
IBM Business Automation Workflow (containers and traditional) may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
- CVE-2026-12730Low
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 fails to properly verify that the hostname matches the server certificate, potentially allowing connections to an attacker-controlled server.
Original NVD description (English source)
IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS