Read the docs
TI-2026-10881 Aliases CVE-2026-12730GHSA-6486-8hjq-q8vf

Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

Priority LOW 17CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMBusiness Automation Workflow containers and traditional26.0.0; 25.0.0 – 25.0.0 Interim Fix 005; 24.0.1 – 24.0.1 Interim Fix 007; 24.0.0 – 24.0.0 Interim Fix 009—No fix listedCNA
  • Business Automation Workflow containers and traditional VendorIBM Affected 26.0.0; 25.0.0 – 25.0.0 Interim Fix 005; 24.0.1 – 24.0.1 Interim Fix 007; 24.0.0 – 24.0.0 Interim Fix 009 Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:*24.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:traditional:*:*:*24.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:*24.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:traditional:*:*:*24.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:*24.0.0 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:traditional:*:*:*24.0.0 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:*24.0.0 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:traditional:*:*:*24.0.0 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:*24.0.0 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:traditional:*:*:*24.0.0 if004VulnerableIBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:* Versions 24.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:traditional:*:*:* Versions 24.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:* Versions 24.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:traditional:*:*:* Versions 24.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:* Versions 24.0.0 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:traditional:*:*:* Versions 24.0.0 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:* Versions 24.0.0 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:traditional:*:*:* Versions 24.0.0 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:* Versions 24.0.0 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:traditional:*:*:* Versions 24.0.0 if004 Vulnerable ·IBM
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:*24.0.0 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:traditional:*:*:*24.0.0 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:*24.0.0 if006VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:traditional:*:*:*24.0.0 if006VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if007:*:*:containers:*:*:*24.0.0 if007VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if007:*:*:traditional:*:*:*24.0.0 if007VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if008:*:*:containers:*:*:*24.0.0 if008VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if008:*:*:traditional:*:*:*24.0.0 if008VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if009:*:*:containers:*:*:*24.0.0 if009VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if009:*:*:traditional:*:*:*24.0.0 if009VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:*24.0.1VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:traditional:*:*:*24.0.1VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:*24.0.1 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:traditional:*:*:*24.0.1 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:*24.0.1 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:traditional:*:*:*24.0.1 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if003:*:*:containers:*:*:*24.0.1 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if003:*:*:traditional:*:*:*24.0.1 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:*24.0.1 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:traditional:*:*:*24.0.1 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:containers:*:*:*24.0.1 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:traditional:*:*:*24.0.1 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if006:*:*:containers:*:*:*24.0.1 if006VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if006:*:*:traditional:*:*:*24.0.1 if006VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if007:*:*:containers:*:*:*24.0.1 if007VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if007:*:*:traditional:*:*:*24.0.1 if007VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:*25.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:traditional:*:*:*25.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:*25.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:traditional:*:*:*25.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:containers:*:*:*25.0.0 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:traditional:*:*:*25.0.0 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if003:*:*:containers:*:*:*25.0.0 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if003:*:*:traditional:*:*:*25.0.0 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if004:*:*:containers:*:*:*25.0.0 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if004:*:*:traditional:*:*:*25.0.0 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if005:*:*:containers:*:*:*25.0.0 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if005:*:*:traditional:*:*:*25.0.0 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:26.0.0:-:*:*:containers:*:*:*26.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:26.0.0:-:*:*:traditional:*:*:*26.0.0VulnerableIBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:* Versions 24.0.0 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:traditional:*:*:* Versions 24.0.0 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:* Versions 24.0.0 if006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:traditional:*:*:* Versions 24.0.0 if006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if007:*:*:containers:*:*:* Versions 24.0.0 if007 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if007:*:*:traditional:*:*:* Versions 24.0.0 if007 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if008:*:*:containers:*:*:* Versions 24.0.0 if008 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if008:*:*:traditional:*:*:* Versions 24.0.0 if008 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if009:*:*:containers:*:*:* Versions 24.0.0 if009 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if009:*:*:traditional:*:*:* Versions 24.0.0 if009 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:* Versions 24.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:traditional:*:*:* Versions 24.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:* Versions 24.0.1 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:traditional:*:*:* Versions 24.0.1 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:* Versions 24.0.1 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:traditional:*:*:* Versions 24.0.1 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if003:*:*:containers:*:*:* Versions 24.0.1 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if003:*:*:traditional:*:*:* Versions 24.0.1 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:* Versions 24.0.1 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:traditional:*:*:* Versions 24.0.1 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:containers:*:*:* Versions 24.0.1 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:traditional:*:*:* Versions 24.0.1 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if006:*:*:containers:*:*:* Versions 24.0.1 if006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if006:*:*:traditional:*:*:* Versions 24.0.1 if006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if007:*:*:containers:*:*:* Versions 24.0.1 if007 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if007:*:*:traditional:*:*:* Versions 24.0.1 if007 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:* Versions 25.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:traditional:*:*:* Versions 25.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:* Versions 25.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:traditional:*:*:* Versions 25.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:containers:*:*:* Versions 25.0.0 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:traditional:*:*:* Versions 25.0.0 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if003:*:*:containers:*:*:* Versions 25.0.0 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if003:*:*:traditional:*:*:* Versions 25.0.0 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if004:*:*:containers:*:*:* Versions 25.0.0 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if004:*:*:traditional:*:*:* Versions 25.0.0 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if005:*:*:containers:*:*:* Versions 25.0.0 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if005:*:*:traditional:*:*:* Versions 25.0.0 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:26.0.0:-:*:*:containers:*:*:* Versions 26.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:26.0.0:-:*:*:traditional:*:*:* Versions 26.0.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12730
  2. 2026-10-03 Alias added: GHSA-6486-8hjq-q8vf

References

Patch 1

  • TI-2022-21536 IBM Business Automation Workflow information disclosure CVSS 3.1HIGH 7.5
  • TI-2018-01487 SQL injection in IBM Business Process Manager CVSS 3.0HIGH 8.8
  • TI-2019-03267 XML external entity injection in IBM Business Automation Workflow CVSS 3.1HIGH 8.2
  • TI-2018-01730 Cross-site request forgery in IBM Business Automation Workflow CVSS 3.0HIGH 8.8
  • TI-2022-20639 IBM Business Automation Workflow cross-site request forgery CVSS 3.1HIGH 8.8
  • TI-2025-11979 XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow - CVSS 3.1HIGH 7.1
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences