IBM Business Automation Workflow containers and traditional are vulnerable to an XML external entity injection (XXE) flaw that allows a remote attacker to process crafted XML data and cause the system to expose sensitive information or consume excessive memory resources. The vulnerability stems from improper handling of external entity references in XML, a weakness that can lead to data leakage and performance degradation. The attacker could therefore compromise confidentiality by retrieving internal data and affect availability through resource exhaustion.

Impacted products include IBM Business Automation Workflow containers and IBM Business Automation Workflow traditional, across multiple releases. Versions affected are 24.0.0 and 24.0.1 (interim fixes 009 and 008), 25.0.0 (interim fixes 005 and 006), and 26.0.0 (interim fixes 001 and 002). Users running any of these releases without the corresponding interim fixes are susceptible to the XXE exploitation.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of 0.00496 shows a very low probability of exploitation, so the current estimate of exploitation likelihood is low. The vulnerability is not listed in CISA KEV, suggesting it has not yet been confirmed as widely exploited, but the nature of the flaw enables remote exploitation via XML-based input. As the flaw relies on XML parsing, the attack vector is likely remote, requiring an attacker to supply malicious XML to the application. Once processed, an attacker can read internal files or databases and potentially exhaust memory, creating a secondary denial‑of‑service effect.