CVE-2026-13449 identifies an XML external entity injection vulnerability in IBM Business Automation Manager Open Editions 9.0.0. The vulnerability arises from improper restriction of XML external entity references during XML data processing. A remote attacker with low privileges can exploit this to disclose sensitive information or consume memory resources, impacting confidentiality and availability. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and high impact on availability. No patch or official remediation level has been disclosed by IBM as of the publication date.

Exploitation of this vulnerability could allow a remote attacker with low privileges to read sensitive information from the system or cause denial of service by exhausting memory resources. The confidentiality and integrity impacts are low, but availability impact is high due to potential resource consumption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting XML input sources or applying XML processing configurations that disable external entity resolution if possible. Monitor IBM advisories for updates on patches or official mitigations.