CVE-2026-12752 is an XML External Entity (XXE) injection vulnerability in IBM Business Automation Workflow containers and traditional editions. When processing XML data, the software improperly restricts XML external entity references, enabling a remote attacker with low privileges to exploit this flaw. Successful exploitation could lead to disclosure of sensitive information and limited denial of service via memory resource consumption. The affected versions explicitly include 24.0.0, 24.0.1, 25.0.0, and 26.0.0. No vendor advisory or patch information is provided in the source data.

A remote attacker with low privileges can exploit this vulnerability to disclose sensitive information and cause partial denial of service by consuming memory resources. The confidentiality impact is high, integrity is not affected, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to XML processing interfaces and monitoring for unusual resource consumption related to XML parsing.