# CVE-2026-12756: IBM Business Automation Workflow XML external entity injection

Source: https://junglewise.ai/threats/cve-2026-12756-ibm-business-automation-workflow-xml-external-entity-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12756 · Severity: high · CVSS 7.1 · Published 2026-09-14

IBM Business Automation Workflow is an enterprise application platform used to automate business processes and document management. A vulnerability allows remote attackers to exploit XML processing to extract sensitive information or cause service disruptions by consuming memory resources without authentication barriers.

Technologies: [IBM Business Automation Workflow](https://junglewise.ai/threats/technologies/business-automation-workflow). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-12756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12756 being exploited in the wild.

**How severe is CVE-2026-12756?** High severity, with a CVSS score of 7.1, published 14 September 2026.

**Which products and versions are affected?** IBM Business Automation Workflow <UNKNOWN>.

**Is there a fix for CVE-2026-12756?** A patch was published on 2026-08: Fix included in August 2026 security update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12756 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-12756?** Check whether you run IBM Business Automation Workflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an XML External Entity (XXE) injection in IBM Business Automation Workflow's XML processing component. An attacker can send specially crafted XML input to trigger entity expansion or file access attacks. The vulnerability requires network access to the XML parser endpoint but does not require prior authentication in the base attack vector. Successful exploitation can lead to information disclosure (sensitive files, configuration data) or denial of service through entity expansion attacks that exhaust memory. Patches are available as part of IBM's August 2026 security update bundle.

## Affected products

- IBM Business Automation Workflow <UNKNOWN>

## Timeline

- 2026-09-14: disclosed
- 2026-08: patched: Fix included in August 2026 security update

## References

- [https://www.ibm.com/support/pages/node/7285930](https://www.ibm.com/support/pages/node/7285930)

## Related threats

- [IBM Business Automation Workflow XML external entity injection](https://junglewise.ai/threats/cve-2026-12752-ibm-business-automation-workflow-xml-external-entity-injection)
- [IBM Business Automation Workflow missing authorization in import](https://junglewise.ai/threats/cve-2026-12742-ibm-business-automation-workflow-missing-authorization-in-import)
- [IBM Business Automation Workflow XML Entity Injection in programming models](https://junglewise.ai/threats/cve-2026-13107-ibm-business-automation-workflow-xml-entity-injection-in)
- [IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through…](https://junglewise.ai/threats/cve-2025-36054-ibm-business-automation-workflow-containers-24-0-0-through-24-0-0)