CVE-2026-13449: IBM Business Automation Manager XXE Vulnerability (CVSS 7.6 HIGH)

Technical summary

This XXE vulnerability (CWE-611) exists in IBM Business Automation Manager's XML processing logic. The application fails to disable external entity resolution when parsing XML input, enabling an attacker with authentication privileges to reference external DTD entities. Successful exploitation can lead to information disclosure via out-of-band channels or server-side request forgery patterns, and can also trigger billion-laughs-style denial-of-service through recursive entity expansion. The CVSS 3.1 score of 7.6 reflects the requirement for prior authentication (PR:L) balanced against the high availability impact (A:H) and confidentiality exposure (C:L).

Business impact

Organizations running affected Business Automation Manager versions face dual risks: potential exposure of configuration data, credentials, or workflow information through successful XXE exploitation, and the ability of an authenticated attacker to mount denial-of-service attacks that interrupt critical business processes. For enterprises using BAM for workflow orchestration, this could disrupt order processing, claim handling, or other automated business functions. The authentication requirement somewhat limits the attack surface but does not eliminate risk if internal users are compromised or if the platform is accessible to privileged external partners.

Affected systems

IBM Business Automation Manager Open Editions versions 9.0.0, 9.1.x, 9.2.x, 9.3.x, and 9.4.0 through 9.4.2 are affected. Deployments outside the open edition product line or running version 9.4.3 and later are unaffected. Verify your specific version through the application's administration console or deployment artifacts.

Exploitability

Exploitation requires valid authentication credentials and the ability to submit XML input to the affected service. While this reduces the attack surface compared to unauthenticated vulnerabilities, the threat remains material in organizations where user account compromise is plausible or where service accounts have broad permissions. There is no public evidence of active exploitation, and the vulnerability was not added to CISA's Known Exploited Vulnerabilities (KEV) catalog, though organizations should not rely on this as assurance against future weaponization.

Remediation

Update IBM Business Automation Manager Open Editions to version 9.4.3 or later to remediate this vulnerability. Organizations unable to update immediately should prioritize restricting network access to BAM services and reviewing authentication logs for suspicious XML submissions or unusual data access patterns. Consider implementing input validation rules at the application or WAF layer to reject payloads containing DOCTYPE declarations or external entity references.

Patch guidance

Verify the availability of patched versions through IBM's security bulletin and product update channels. Apply updates to development and test environments first to validate compatibility with your workflow definitions and custom extensions. If you are running Business Automation Manager in a containerized environment, ensure container images are rebuilt from patched base versions. Document the patch date and version for audit and compliance purposes.

Detection guidance

Monitor for XML parsing errors, failed DOCTYPE declarations in application logs, and requests containing suspicious strings such as '<!DOCTYPE', 'SYSTEM', or 'PUBLIC' in the request body directed at BAM services. Network-based detection should flag outbound connections initiated by the Business Automation Manager process to unexpected external hosts, which may indicate XXE-based exfiltration. Review access logs for authentication events followed closely by unusual XML submissions or administrative data queries.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score, the potential for both confidentiality breach and availability disruption, and the broad version range affected. While authentication is required, the business-critical nature of workflow automation platforms and the ease of credential compromise in modern threat landscapes justify rapid patching. Organizations should treat this as a medium-to-high priority remediation within the next 30 days.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) reflects: network-based attack vector (AV:N) requiring no special conditions to deliver (AC:L), low authentication burden (PR:L) since an authenticated user can trigger the flaw, scope unchanged (S:U), limited confidentiality impact (C:L) due to information disclosure potential, limited integrity impact (I:L) from potential data modification, and high availability impact (A:H) from resource exhaustion attacks. The score appropriately elevates the severity because denial-of-service risk to a critical platform justifies urgent action despite the authentication requirement.

Frequently asked questions