Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by ibm

CVE-2026-12730Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers

Low 3.8

In plain English

A low-severity security flaw in Business Automation Workflow containers and traditional from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.2%top 94.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.

Affected products (as reported)

VendorProductVersions
IBM Business Automation Workflow containers and traditional 26.0.025.0.0 – through 25.0.0 Interim Fix 00524.0.1 – through 24.0.1 Interim Fix 00724.0.0 – through 24.0.0 Interim Fix 009

Weakness: CWE-297 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References