CVE-2026-1248: business automation workflow 24.0.0, 24.0.1, 25.0.0 (+1 more affected versions); +1 more affected products

Affected technology

business automation workflow · 24.0.0
ibm

business automation workflow · 24.0.0 · update if001
ibm

business automation workflow · 24.0.0 · update if002
ibm

business automation workflow · 24.0.0 · update if003
ibm

business automation workflow · 24.0.0 · update if004
ibm

business automation workflow · 24.0.0 · update if005
ibm

business automation workflow · 24.0.0 · update if006
ibm

business automation workflow · 24.0.0 · update if007
ibm

business automation workflow · 24.0.0 · update if008
ibm

business automation workflow · 24.0.1
ibm

business automation workflow · 24.0.1 · update if001
ibm

business automation workflow · 24.0.1 · update if002
ibm

business automation workflow · 24.0.1 · update if003
ibm

business automation workflow · 24.0.1 · update if004
ibm

business automation workflow · 24.0.1 · update if005
ibm

business automation workflow · 24.0.1 · update if006
ibm

business automation workflow · 25.0.0
ibm

business automation workflow · 25.0.0 · update if001
ibm

business automation workflow · 25.0.0 · update if002
ibm

business automation workflow · 25.0.0 · update if003
ibm

business automation workflow · 25.0.1
ibm

Business Automation Workflow containers and traditional · 25.0.1, 25.0.0 through 25.0.0 Interim Fix 003, 24.0.1 through 24.0.1 Interim Fix 006, 24.0.0 through 24.0.0 Interim Fix 008
IBM

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.