CVE-2026-13107

Received Received - Intake

XML Entity Injection in IBM Business Automation Workflow

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: IBM Corporation

Description

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-13107

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	business_automation_workflow	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability involves IBM Business Automation Workflow containers and traditional setups using programming model artifacts that are vulnerable to XML Entity Injection attacks by default. This means attackers could manipulate XML input to access sensitive data or perform unauthorized actions.

Detection Guidance

Detection of XML Entity Injection vulnerabilities typically involves inspecting XML parsers and applications handling XML input. Check for unusual XML input handling in IBM Business Automation Workflow containers or traditional deployments. Review application logs for malformed XML requests or errors related to XML parsing. Use tools like OWASP ZAP or Burp Suite to test for XML injection by sending crafted XML payloads.

Impact Analysis

The vulnerability could allow attackers to read sensitive files, perform denial-of-service attacks, or gain unauthorized access to systems. It primarily affects confidentiality and integrity, with a high impact on confidentiality due to potential data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized data access or exposure. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Disable XML Entity Injection by configuring the application to disable DTD processing in XML parsers. Update IBM Business Automation Workflow to the latest version that patches this issue. Restrict user permissions to minimize potential impact.

Hi! I’m here to help you understand CVE-2026-13107. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70