Business Automation Workflow vulnerabilities

3 known vulnerabilities in Business Automation Workflow from IBM. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Business Automation Workflow containers: Server-Side Request Forgery

  CVE-2025-13096Feb 2, 2026IBM

  IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attac

• 7.5 High severity

  Business Monitor: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-43864Jan 26, 2023IBMEPSS 2.02%

  IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 239

• 8.8 High severity

  Business Automation Workflow: Cross-Site Request Forgery

  CVE-2022-42435Jan 4, 2023IBM

  IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions