CVE-2026-3207
Published: 17 March 2026
Summary
CVE-2026-3207 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Tibco Bpm Enterprise. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-17 (Remote Access).
Deeper analysis
CVE-2026-3207 is a configuration issue in the Java Management Extensions (JMX) component of TIBCO BPM Enterprise version 4.x that allows unauthorized access. Published on 2026-03-17, the vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-306 (Missing Authentication for Critical Function).
The vulnerability enables exploitation over the network with low attack complexity, requiring no privileges, user interaction, or scope changes. A successful attack can result in high impacts to confidentiality, integrity, and availability, potentially allowing an unauthenticated remote attacker to fully compromise the affected TIBCO BPM Enterprise instance.
TIBCO has published a security advisory addressing CVE-2026-3207, available at https://community.tibco.com/advisories/tibco-security-advisory-march-17-2026-tibco-bpm-enterprise-cve-2026-3207-r226/, which provides details on mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12625
Vulnerability details
Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on the exposed JMX management interface (CWE-306) directly enables remote unauthenticated exploitation of a public-facing application, resulting in full compromise of the TIBCO BPM instance.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Establishes and enforces secure configuration settings for the JMX component to require authentication, directly mitigating the configuration issue enabling unauthorized access.
Explicitly authorizes and limits any permitted actions without identification or authentication, preventing unauthorized use of critical JMX functions.
Manages and restricts remote access mechanisms like JMX to prevent network-based unauthorized exploitation.