XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

Successful exploitation of CVE-2025-13096 could lead to significant data breaches. An attacker could craft malicious XML payloads to read arbitrary files on the server, potentially exposing configuration files, database credentials, or other sensitive data. Beyond data exfiltration, the XXE attack can be leveraged for denial-of-service (DoS) by consuming excessive memory resources, rendering the Business Automation Workflow instance unavailable. The impact is particularly severe in environments where Business Automation Workflow handles sensitive business processes or integrates with critical systems.

Organizations heavily reliant on IBM Business Automation Workflow for critical business processes, particularly those handling sensitive data such as financial information or personal data, are at significant risk. Shared hosting environments where multiple tenants share the same Business Automation Workflow instance are also vulnerable, as an attacker could potentially exploit the vulnerability to access data belonging to other tenants.

• linux / server: Monitor Business Automation Workflow logs for unusual XML processing activity or errors related to external entity resolution. Use journalctl -u ba-workflow to filter for relevant log entries.

journalctl -u ba-workflow | grep -i "external entity"

• generic web: Use curl to test for XXE vulnerabilities by sending crafted XML payloads containing external entity declarations. Examine the response for any signs of file disclosure or error messages.

curl -X POST -d '<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <a href=&xxe;'>' https://<your_baw_url>/baw/process/MyProcess

• ibm: Review IBM Business Automation Workflow audit logs for suspicious XML processing requests. Consult IBM's security bulletins for specific detection signatures or recommendations.

1. 2026-02-02Disclosure

   disclosure

1. Reserviert2025-11-12
2. Veröffentlicht2026-02-02
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13096 is to upgrade to IBM Business Automation Workflow version 25.0.1 or later. If immediate upgrading is not feasible, consider implementing input validation and sanitization on all XML data processed by the system. Configure your WAF to block XML requests containing suspicious external entity declarations. Review and restrict file access permissions to minimize the potential impact of a successful XXE attack. After upgrading, confirm the fix by attempting to trigger an XXE payload and verifying that it is properly blocked.