CVE-2026-13449 is an XML External Entity (XXE) injection vulnerability in IBM Business Automation Manager Open Editions versions 9.0.0 through 9.4.2. The vulnerability arises from improper restriction of XML external entity references during XML data processing. An attacker with network access and low privileges can exploit this flaw to disclose sensitive information or impact system availability by consuming memory resources. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information and denial of service conditions due to memory exhaustion. The attacker requires network access and low privileges, increasing the risk in environments where such access is possible. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented as of the published date. Users should monitor IBM advisories for updates and consider restricting XML input sources or applying XML parser configurations that disable external entity processing as a temporary mitigation if feasible.