CVE-2026-93891: CWE-611 Improper Restriction of XML External Entity Reference in IBM TRIRIGA Application Platform

CVE-2026-93891 is an XML External Entity (XXE) injection vulnerability in IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8. This vulnerability allows a remote attacker with authentication privileges to exploit improper restriction of XML external entity references, potentially leading to disclosure of sensitive information. The CVSS 3.1 base score is 7.6, reflecting high severity with network attack vector, low attack complexity, and high privileges required. The vulnerability impacts confidentiality and availability but does not affect integrity. No known exploits in the wild or vendor patch information are currently available.

A remote authenticated attacker can exploit this XXE vulnerability to obtain sensitive information from the affected IBM TRIRIGA Application Platform versions. The vulnerability impacts confidentiality and availability, potentially allowing information disclosure and limited denial of service. Integrity is not affected. The attack requires authentication and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor IBM advisories for updates. Until a fix is available, limit access to trusted authenticated users and consider additional XML input validation controls if feasible.