CVE-2026-12730
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 fails to properly verify that the hostname matches the server certificate, potentially allowing connections to an attacker-controlled server.
Risk Assessment
An attacker could perform a man-in-the-middle attack, intercepting or modifying communications, potentially leading to disclosure of sensitive data or integrity compromise.
Recommendation
Upgrade IBM Business Automation Workflow to a patched version if available. Also configure proper certificate and hostname verification.
Original NVD description (English source)
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.