CVE-2026-93891 PUBLISHED

Security Vulnerability identified in IBM TRIRIGA - XXE

Assigner: ibm
Reserved: 18.09.2026 Published: 12.10.2026 Updated: 13.10.2026

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS Score: 7.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	IBM
Product	TRIRIGA Application Platform
Versions	affected from 5.0.0 to 5.0.8 (incl.)

Solutions

Customers using affected versions of IBM TRIRIGA should upgrade to IBM TRIRIGA Application Platform 5.0.9 or a later supported release containing the fix. IBM recommends applying the latest available maintenance to ensure protection against this vulnerability.

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/IBM+TRIRIGA+Application+Platform&release=5.0.8&platform=All&function=all

References

https://www.ibm.com/support/pages/node/7292036

Problem Types

CWE-611 Improper Restriction of XML External Entity Reference CWE