CVE-2026-13449: IBM Business Automation Manager Open Editions XML External Entity Injection (XXE)
IBM Business Automation Manager Open Editions is affected by an XML external entity injection (XXE) weakness that a remote attacker could use to expose sensitive information or consume memory. NVD scores it 9.1 (critical) under CVSS 3.1, while the CNA IBM scores it 7.6. The record lists no fixed version and no listing in the CISA KEV catalog.
Overview
IBM has published a vendor advisory for CVE-2026-13449, an XML external entity injection (XXE) weakness classified as CWE-611 in IBM Business Automation Manager Open Editions. The issue arises when the product processes XML data. The NVD record assigns a CVSS 3.1 base score of 9.1, which is rated critical.
Impact
According to the published description, a remote attacker could use this weakness to expose sensitive information or consume memory resources. The NVD vector indicates high confidentiality impact, no integrity impact, and high availability impact, with no privileges or user interaction required.
Affected products and versions
- Product: IBM Business Automation Manager Open Editions
- Range in the published description: 9.0.0 through 9.4.2
- Range recorded in the affected data: 9.0.0 or later and before 9.5.0
Consult the IBM security bulletin for the authoritative list of affected releases.
Exploitation status
The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted for this analysis. The EPSS data in the record shows a probability of 0.00406 and a percentile of 0.33041.
Remediation and mitigation
The record does not list any fixed version. This does not mean that no fix exists. Administrators should review the IBM security bulletin for remediation guidance, apply vendor-supplied updates when they become available, and limit network exposure of the affected service in the meantime. Restricting which sources may submit XML to the product and confirming that external entity and DTD resolution are disabled where the product allows it are common defensive measures for XXE issues, but any configuration change should be validated against vendor documentation first.
Detection guidance
- Review application and web server logs for unusual XML requests to the product, especially those with unexpected size or structure.
- Monitor for abnormal memory consumption, repeated service restarts, or degraded performance that could indicate resource exhaustion.
- Track unexpected outbound connections from the application server, since XXE conditions can cause a server to fetch external resources.
Limitations of the available information
The record does not list fixed versions, patch identifiers, or the specific components and endpoints involved. Two CVSS 3.1 scores are present: 9.1 from NVD and 7.6 from the CNA. The record also contains no title, so the title shown here was written for this analysis.
Frequently asked questions
What is the severity of CVE-2026-13449?
NVD scores it 9.1 under CVSS 3.1 with a critical rating. The CNA IBM provides a separate CVSS 3.1 score of 7.6.
Is this CVE being actively exploited?
The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted for this analysis.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.