High severity · published Mar 24, 2026
CVE-2026-3912
TIBCO ActiveMatrix BusinessWorks Injection Vulnerability
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator allows information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
ActiveMatrix BusinessWorks · Tibco
6.12.0 before HF1; 6.11.0 before HF4; 6.10.0 before HF6; 6.9.1 before HF8 · source: vendor
EA
Enterprise Administrator · Tibco
2.4.3 before HF2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3912
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3912
community.tibco.com
https://community.tibco.com/advisories/tibco-security-advisory-march-24-2026-tibco-activematrix-businessworks-cve-2026-3912-r227/
More from ActiveMatrix BusinessWorks
8.1
CVE-2019-8990
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be…
7.5
CVE-2018-12408
TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
–
CVE-2012-0687
TIBCO ActiveMatrix Runtime Platform in Service Grid and Service Bus 2.x before 2.3.2 and BusinessWorks Service Engine before 5.8.2; TIBCO ActiveMatrix Platform in TIBCO Silver…