CVE-2026-12759: IBM Cloud Pak Business Automation DoS Flaw

CVE-2026-12759 Overview

CVE-2026-12759 affects IBM Cloud Pak for Business Automation, a container-based platform for automating business workflows and decisions. An authenticated user can trigger a denial of service (DoS) condition through uncontrolled resource consumption [CWE-400]. The flaw allows a low-privileged attacker with network access to exhaust system resources and disrupt service availability for other users.

The vulnerability requires valid authentication but no user interaction. Exploitation impacts confidentiality according to the CVSS vector, indicating that resource exhaustion may expose sensitive processing data during degraded operation. IBM has published a support advisory addressing the issue.

Critical Impact
An authenticated attacker can exhaust platform resources over the network, degrading availability of automation workflows for legitimate users.

Affected Products

IBM Cloud Pak for Business Automation
Refer to the IBM Support Article for specific affected versions
Deployments across supported container orchestration platforms

Discovery Timeline

2026-09-14 - CVE-2026-12759 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-12759

Vulnerability Analysis

CVE-2026-12759 is classified as Uncontrolled Resource Consumption [CWE-400]. IBM Cloud Pak for Business Automation fails to enforce sufficient limits on operations initiated by authenticated users. An attacker holding valid credentials can submit requests that consume disproportionate CPU, memory, or backend resources.

The flaw is reachable over the network and does not require elevated privileges or user interaction. Because the platform orchestrates shared automation workloads, resource exhaustion in one tenant or workflow can degrade service for all consumers of the affected component. The CVSS vector indicates a confidentiality impact, suggesting that resource pressure may cause the platform to expose data that would otherwise remain protected.

Root Cause

The root cause is the absence or insufficiency of resource governance on user-controllable operations. Without quotas, rate limits, or input bounds, the platform processes requests that scale linearly or worse with attacker-supplied parameters. This class of weakness commonly appears in APIs that accept unbounded payloads, run expensive queries, or allocate memory proportional to client input.

Attack Vector

Exploitation requires network access to the Cloud Pak for Business Automation endpoints and a low-privileged authenticated session. The attacker issues one or more crafted requests designed to trigger expensive operations. Sustained abuse depletes available resources and produces the denial-of-service condition. See the IBM Support Article for the vendor's technical description.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.371%.

Detection Methods for CVE-2026-12759

Indicators of Compromise

Sustained high CPU or memory utilization on Cloud Pak for Business Automation pods without a corresponding legitimate workload increase
Elevated request rates from a single authenticated user or service account to automation APIs
Timeouts, 5xx errors, or pod restarts affecting business automation services
Backend datastore saturation coincident with unusual API traffic patterns

Detection Strategies

Baseline normal request volumes and payload sizes per authenticated principal, then alert on statistical outliers
Instrument application logs to record request duration, payload size, and resource consumption per API call
Correlate authentication events with resource utilization metrics to attribute spikes to specific accounts

Monitoring Recommendations

Enable Kubernetes resource metrics (CPU, memory, restarts) for all Cloud Pak for Business Automation namespaces
Forward IBM Cloud Pak audit and access logs to a centralized SIEM for correlation and retention
Configure alerts for repeated request patterns from single principals that exceed established thresholds
Monitor container orchestration events for OOMKilled pods and eviction notices

How to Mitigate CVE-2026-12759

Immediate Actions Required

Apply the fix documented in the IBM Support Article as soon as it is validated in a non-production environment
Review and rotate credentials for accounts with access to Cloud Pak for Business Automation APIs
Restrict network exposure of the platform to trusted management networks where feasible
Audit recent access logs for anomalous request patterns from authenticated users

Patch Information

IBM has published guidance for CVE-2026-12759 in the vendor advisory. Consult the IBM Support Article for the specific fix pack, iFix, or version required for your deployment and follow IBM's documented upgrade procedure.

Workarounds

Enforce API rate limits and per-user quotas at an ingress or API gateway layer in front of Cloud Pak for Business Automation
Apply Kubernetes resource requests and limits to Cloud Pak workloads to contain the blast radius of exhaustion
Reduce the number of accounts with access to affected endpoints and apply least-privilege principles to service accounts
Monitor and alert on resource saturation so responders can revoke abusive sessions quickly

bash

# Example: apply per-user rate limiting at an NGINX ingress in front of Cloud Pak
# limit each authenticated principal to 10 requests/second with a burst of 20
limit_req_zone $http_authorization zone=cp4ba_user:10m rate=10r/s;

server {
    location /automation/ {
        limit_req zone=cp4ba_user burst=20 nodelay;
        proxy_pass https://cp4ba-backend;
    }
}