CVE-2026-13449 is a high severity XML external entity flaw (CVSS 7.6) in IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2. A remote attacker can expose sensitive information or consume memory. IBM says to update to 9.5.0 and lists no workaround.
What's affected
IBM lists IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 as affected. The remedy is an update to 9.5.0. IBM notes that the download link for 9.5 would be published after general availability was announced, so check the bulletin for the current link. IBM lists no workarounds or mitigations.
How to check if you're exposed
Read the product version from your installation or from the deployment manifest. If it falls in 9.0.0 to 9.4.2, it is affected. Then list which services accept XML from users or from other systems, and who can reach them. The record says a remote attacker needs a low privilege account, so account scope matters.
What to do now
- Inventory all BAMOE installations and note versions.
- Plan the upgrade to 9.5.0 using the instructions in the IBM bulletin.
- Limit network access to the application to people and systems that need it.
- Review accounts with permission to upload or submit XML content.
- Monitor memory use on the service for unexplained spikes.
Why it matters
XML allows entity references. If the parser resolves external entities, a document can make the server read local files or fetch remote content, and a crafted one can also exhaust memory. The standard defense is to turn off external entity and document type processing in the parser, which the vendor has presumably handled in 9.5.0, though the bulletin does not detail the change.
The score is high with a low privilege requirement. The record does not flag this CVE as known exploited.
The record lists this weakness class: CWE-611 (Improper Restriction of XML External Entity Reference).
Quick check
Is there a stopgap until I can upgrade?
IBM lists no workarounds. Limiting who can reach and submit XML to the service reduces exposure but is not a fix.
Sources
Last reviewed: 19 October 2026.
