IBM Business Automation Manager XXE Vulnerability Advisory (CVE-2026-13449)

Vulnerability Overview IBM Business Automation Manager Open Editions 9.5.0 contains multiple security vulnerabilities, specifically: CVE ID: CVE-2026-13449 Description: IBM Business Automation Manager Open Editions is vulnerable to XML External Entity (XXE) injection when processing XML data. A remote attacker can exploit this vulnerability to expose sensitive information or consume memory resources. CWE: CWE-611: Improper Restriction of XML External Entity Reference CVSS Source: IBM CVSS Base Score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Affected Scope Affected Product: IBM Business Automation Manager Open Editions Affected Versions: 9.0.0 - 9.4.2 Remediation Fixed Version: 9.5.0 Remediation Details: Update to version 9.5.0 using the following documentation: IBM Business Automation Manager Open Editions 9.5 Download Document Note: Reference links are not yet public and will be provided after the GA (General Availability) release. Additional Information Release Date: June 30, 2026 Modification Date: June 30, 2026 Initial Release Date: June 30, 2026 Reference Links Complete CVSS v3 Guide Online Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" intended to communicate vulnerability severity and help determine the urgency and priority of response. IBM provides CVSS scores "as is" without any expressed or implied warranties, including but not limited to warranties of merchantability and fitness for a particular purpose. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates the records of components within its product portfolio to reflect newly discovered vulnerabilities. IBM does not guarantee that the referenced products have been in use by IBM since the date specified, nor does it guarantee that IBM was aware of the vulnerability at the time of its disclosure. We strive to keep customers informed about vulnerabilities we are aware of. The "Affected Products and Versions" section of IBM Security Bulletins refers only to IBM-supported and non-extended-support products and versions. Therefore, the exclusion of unsupported or extended-support products and versions from these references does not constitute a determination by IBM that unsupported versions are not subject to obligations. The citation of one or more unsupported versions in this security bulletin does not impose an obligation on IBM to fix any unsupported or extended-support product or version.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Business Automation Manager XXE Vulnerability Advisory (CVE-2026-13449)