CVE-2026-12730
Received Received - Intake

IBM Business Automation Workflow Hostname Verification Bypass

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: IBM Corporation

Description
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-12730
EUVD
EUVD-2026-53437

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm business_automation_workflow 26.0.0
ibm business_automation_workflow 25.0.0
ibm business_automation_workflow 24.0.1
ibm business_automation_workflow 24.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Business Automation Workflow fails to verify that the hostname matches the server certificate. This could allow connections to an attacker-controlled server instead of the intended legitimate server.

Impact Analysis

An attacker could intercept or manipulate data transmitted between systems by impersonating a trusted server. This may lead to unauthorized access, data breaches, or man-in-the-middle attacks affecting confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or tampering, violating requirements for data protection and integrity in GDPR and HIPAA. Non-compliance risks include legal penalties and loss of trust.

Mitigation Strategies

Update IBM Business Automation Workflow to a patched version as soon as possible. Verify server certificates match hostnames before establishing connections. Monitor network traffic for unauthorized connections to untrusted servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart