CVE-2025-13096: XXE Injection in IBM Business Automation Workflow

Successful exploitation of CVE-2025-13096 could lead to significant data breaches. An attacker could craft malicious XML payloads to read arbitrary files on the server, potentially exposing configuration files, database credentials, or other sensitive data. Beyond data exfiltration, the XXE attack can be leveraged for denial-of-service (DoS) by consuming excessive memory resources, rendering the Business Automation Workflow instance unavailable. The impact is particularly severe in environments where Business Automation Workflow handles sensitive business processes or integrates with critical systems.

1. Reserved2025-11-12
2. Published2026-02-02
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13096 is to upgrade to IBM Business Automation Workflow version 25.0.1 or later. If immediate upgrading is not feasible, consider implementing input validation and sanitization on all XML data processed by the system. Configure your WAF to block XML requests containing suspicious external entity declarations. Review and restrict file access permissions to minimize the potential impact of a successful XXE attack. After upgrading, confirm the fix by attempting to trigger an XXE payload and verifying that it is properly blocked.