CVE-2026-3207

CRITICAL

TIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability

Title source: cna
STIX 2.1

Description

Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.

References (1)

Scores

CVSS v3 9.8
EPSS 0.0005
EPSS Percentile 15.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-306
Status published
Products (2)
tibco/bpm_enterprise 4.3.0 - 4.3.5
TIBCO/TIBCO BPM Enterprise 4.3 - 5
Published Mar 17, 2026
Tracked Since Mar 18, 2026