CVE-2026-3912

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3912", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "state": "PUBLISHED", "assignerShortName": "tibco", "dateReserved": "2026-03-11T04:50:22.400Z", "datePublished": "2026-03-24T20:44:06.781Z", "dateUpdated": "2026-03-25T13:33:23.189Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2026-03-24T20:44:06.781Z"}, "title": "TIBCO ActiveMatrix BusinessWorks Injection Vulnerability", "affected": [{"vendor": "Tibco", "product": "ActiveMatrix BusinessWorks", "versions": [{"status": "affected", "version": "6.12.0", "lessThan": "HF1", "versionType": "Hotfix"}, {"status": "affected", "version": "6.11.0", "lessThan": "HF4", "versionType": "Hotfix"}, {"status": "affected", "version": "6.10.0", "lessThan": "HF6", "versionType": "Hotfix"}, {"status": "affected", "version": "6.9.1", "lessThan": "HF8", "versionType": "Hotfix"}], "defaultStatus": "unaffected"}, {"vendor": "Tibco", "product": "Enterprise Administrator", "versions": [{"status": "affected", "version": "2.4.3", "lessThan": "HF2", "versionType": "Hotfix"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Injection vulnerabilities due to validation/sanitisation of user-supplied input in\u00a0ActiveMatrix BusinessWorks and\u00a0Enterprise Administrator allows\u00a0information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>Injection vulnerabilities due to validation/sanitisation of user-supplied input in&nbsp;ActiveMatrix BusinessWorks and&nbsp;Enterprise Administrator allows&nbsp;information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour.</span></div>"}]}], "references": [{"url": "https://community.tibco.com/advisories/tibco-security-advisory-march-24-2026-tibco-activematrix-businessworks-cve-2026-3912-r227/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:33:20.540890Z", "id": "CVE-2026-3912", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:33:23.189Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "TIBCO ActiveMatrix BusinessWorks Injection Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tibco", "product": "ActiveMatrix BusinessWorks", "versions": [{"status": "affected", "version": "6.12.0", "lessThan": "HF1", "versionType": "Hotfix"}, {"status": "affected", "version": "6.11.0", "lessThan": "HF4", "versionType": "Hotfix"}, {"status": "affected", "version": "6.10.0", "lessThan": "HF6", "versionType": "Hotfix"}, {"status": "affected", "version": "6.9.1", "lessThan": "HF8", "versionType": "Hotfix"}], "defaultStatus": "unaffected"}, {"vendor": "Tibco", "product": "Enterprise Administrator", "versions": [{"status": "affected", "version": "2.4.3", "lessThan": "HF2", "versionType": "Hotfix"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.tibco.com/advisories/tibco-security-advisory-march-24-2026-tibco-activematrix-businessworks-cve-2026-3912-r227/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Injection vulnerabilities due to validation/sanitisation of user-supplied input in\u00a0ActiveMatrix BusinessWorks and\u00a0Enterprise Administrator allows\u00a0information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour.", "supportingMedia": [{"type": "text/html", "value": "<div><span>Injection vulnerabilities due to validation/sanitisation of user-supplied input in&nbsp;ActiveMatrix BusinessWorks and&nbsp;Enterprise Administrator allows&nbsp;information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour.</span></div>", "base64": false}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2026-03-24T20:44:06.781Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-25T13:33:20.540890Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-25T13:33:13.388Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-3912", "state": "PUBLISHED", "dateUpdated": "2026-03-24T20:44:06.781Z", "dateReserved": "2026-03-11T04:50:22.400Z", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "datePublished": "2026-03-24T20:44:06.781Z", "assignerShortName": "tibco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ActiveMatrix BusinessWorks", "vendor": "Tibco", "versions": [{"lessThan": "HF1", "status": "affected", "version": "6.12.0", "versionType": "Hotfix"}, {"lessThan": "HF4", "status": "affected", "version": "6.11.0", "versionType": "Hotfix"}, {"lessThan": "HF6", "status": "affected", "version": "6.10.0", "versionType": "Hotfix"}, {"lessThan": "HF8", "status": "affected", "version": "6.9.1", "versionType": "Hotfix"}]}, {"defaultStatus": "unaffected", "product": "Enterprise Administrator", "vendor": "Tibco", "versions": [{"lessThan": "HF2", "status": "affected", "version": "2.4.3", "versionType": "Hotfix"}]}], "source": "security@tibco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Injection vulnerabilities due to validation/sanitisation of user-supplied input in\u00a0ActiveMatrix BusinessWorks and\u00a0Enterprise Administrator allows\u00a0information disclosure, including exposure of accessible local files and host system details, and may allow manipulation of application behaviour."}, {"lang": "es", "value": "Vulnerabilidades de inyecci\u00f3n debido a la validaci\u00f3n/sanitizaci\u00f3n de la entrada proporcionada por el usuario en ActiveMatrix BusinessWorks y Enterprise Administrator permite la revelaci\u00f3n de informaci\u00f3n, incluyendo la exposici\u00f3n de archivos locales accesibles y detalles del sistema anfitri\u00f3n, y puede permitir la manipulaci\u00f3n del comportamiento de la aplicaci\u00f3n."}], "id": "CVE-2026-3912", "lastModified": "2026-06-17T10:44:24.780", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@tibco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3912", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:33:20.540890Z", "version": "2.0.3"}}]}, "published": "2026-03-24T21:16:29.440", "references": [{"source": "security@tibco.com", "url": "https://community.tibco.com/advisories/tibco-security-advisory-march-24-2026-tibco-activematrix-businessworks-cve-2026-3912-r227/"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.12.0,HF1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.11.0,HF4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.10.0,HF6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.9.1,HF8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ActiveMatrix BusinessWorks", "source": "cna", "vendor": "Tibco"}, "product": "activematrix_businessworks", "vendor": "tibco"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.4.3,HF2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Administrator", "source": "cna", "vendor": "Tibco"}, "product": "enterprise_administrator", "vendor": "tibco"}], "analysis": {"en": {"generated_at": "2026-03-25T15:24:28.932831+00:00", "value": {"mitigation_remediation": ["Apply the patch or upgrade to a fixed release supplied by TIBCO as detailed in their security advisory.", "Disable or restrict any components or features that accept unsecured user input until a patch is applied.", "Implement additional input validation or sanitisation within the application to thwart injection attempts.", "Review system configuration to mitigate accidental exposure of local files and ensure access controls are properly enforced."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure & Behavior Manipulation"}, "threat_synthesis": {"affected_systems": "Vendors affected include TIBCO, specifically the ActiveMatrix BusinessWorks and Enterprise Administrator products. No specific version details are provided in the advisory, so the risk applies to any installations of these products that have not applied an available fix.", "description_and_impact": "The vulnerability stems from insufficient validation and sanitisation of user\u2011supplied input in TIBCO ActiveMatrix BusinessWorks and the Enterprise Administrator component. This flaw allows attackers to inject arbitrary content that the system processes, leading to disclosure of sensitive local files and host system details, and may also permit manipulation of application behaviour.", "risk_and_exploitability": "With a CVSS score of 8.7, the issue is considered High severity. The EPSS score indicates a low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is via unsanitised user input supplied through exposed interfaces, which is inferred based on the description that injection allows disclosure and manipulation."}}}}, "created": "2026-03-25T11:45:50.306132+00:00", "updated": "2026-03-25T20:57:15.977230+00:00", "vendors": ["tibco", "tibco$PRODUCT$activematrix_businessworks", "tibco$PRODUCT$enterprise_administrator"]}