CVE-2026-13107
HighCVSS 7.1Summary
IBM Business Automation Workflow (containers and traditional) may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.
Risk Assessment
An attacker can exploit XML entity injection to read files or perform SSRF attacks, threatening confidentiality and integrity.
Recommendation
Update IBM Business Automation Workflow to a patched version and configure XML security settings.
Other vulnerabilities in IBM Business Automation Workflow
See all- CVE-2026-12756High
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-12730Low
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 fails to properly verify that the hostname matches the server certificate, potentially allowing connections to an attacker-controlled server.
Original NVD description (English source)
IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.