Description
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Published: 2026-10-12
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Sensitive Data Disclosure
Action: Immediate Patch
AI Analysis

Impact

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an XML External Entity (XXE) injection flaw that permits a remote, authenticated attacker to leverage the platform’s XML parsing to read sensitive data that is not otherwise exposed through the normal application interface. The vulnerability does not provide remote code execution but can expose confidential information, potentially compromising confidentiality and integrity of the data stored within the system.

Affected Systems

The affected product is IBM:TRIRIGA Application Platform, specifically the 5.0.0 to 5.0.8 release line. Any environment running one of these versions is vulnerable, including the 5.0.8 variant referenced in the CPEs.

Risk and Exploitability

The flaw has a CVSS score of 7.6, indicating a high risk to affected deployments. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited in the wild. Likely exploitation requires the attacker to authenticate to the application and supply malicious XML input to a feature that processes untrusted XML payloads.

Generated by OpenCVE AI on October 13, 2026 at 00:39 UTC.

Remediation

Vendor Solution

Customers using affected versions of IBM TRIRIGA should upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release containing the fix. IBM recommends applying the latest available maintenance to ensure protection against this vulnerability. https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+TRIRIGA+Application+Platform&release=5.0.8&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release that includes the fix
  • Apply the latest maintenance release to ensure protection against the vulnerability
  • Configure the application’s XML parser to disallow external entities and DTD processing to prevent XXE attacks

Generated by OpenCVE AI on October 13, 2026 at 00:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Title Security Vulnerability identified in IBM TRIRIGA - XXE
First Time appeared Ibm
Ibm tririga Application Platform
Weaknesses CWE-611
CPEs cpe:2.3:a:ibm:tririga_application_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:tririga_application_platform:5.0.8:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm tririga Application Platform
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Ibm Tririga Application Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:48:57.044Z

Reserved: 2026-09-18T20:26:39.474Z

Link: CVE-2026-93891

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T23:17:45.663

Modified: 2026-10-12T23:17:45.663

Link: CVE-2026-93891

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:45:18Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference