Low severity · published Aug 5, 2026
CVE-2026-12730
Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers
3.8
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Business Automation Workflow containers and traditional · IBM
26.0.0; 25.0.0 through 25.0.0 Interim Fix 005; 24.0.1 through 24.0.1 Interim Fix 007; 24.0.0 through 24.0.0 Interim Fix 009 · source: vendor
BA
Business Automation Workflow · Ibm
24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; 24.0.0; +34 more · source: NVD
Affected product
BA
Business Automation Workflow containers and traditional
IBM
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12730
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12730
Vendor Advisory
https://www.ibm.com/support/pages/node/7282596
More from Business Automation Workflow containers and traditional
7.1
CVE-2026-12752
Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026
7.1
CVE-2026-12756
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
7.1
CVE-2026-13107
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
5.4
CVE-2026-12742
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
4.3
CVE-2026-1248
IBM Business Automation Workflow information leak