TIBCO Software vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited TIBCO Software flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2018-18809 TIBCO JasperReports Library Directory TraversalExploited since Dec 29, 2022 · CVSS 6.5
• CVE-2018-5430 TIBCO JasperReports Server Information DisclosureExploited since Dec 29, 2022 · CVSS 8.8

Latest high and critical flaws

• CVE-2026-4034 Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based adminHigh 8.7 · Sep 29, 2026
• CVE-2026-3912 Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator allows information diHigh 8.7 · Mar 24, 2026
• CVE-2026-3207 Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.High 8.7 · Mar 17, 2026
• CVE-2025-3751 The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack.High 7 · May 21, 2025
• CVE-2025-2261 Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of tHigh 7 · May 21, 2025
• CVE-2024-10218 XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational IntelligenceCritical 9.2 · Nov 12, 2024
• CVE-2024-10217 XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational IntelligenceCritical 9.2 · Nov 12, 2024
• CVE-2024-3323 Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executableHigh 8.3 · Apr 17, 2024
• CVE-2024-1138 The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network accHigh 8.8 · Mar 12, 2024
• CVE-2023-26222 The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulneHigh 8.7 · Nov 14, 2023
• CVE-2023-26219 The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence High 7.4 · Oct 25, 2023
• CVE-2023-26218 The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a lowHigh 8 · Sep 29, 2023
• CVE-2023-26217 The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user witHigh 8.8 · Jul 19, 2023
• CVE-2023-26216 The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accCritical 9.1 · May 25, 2023
• CVE-2023-26215 The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to readHigh 7.7 · May 25, 2023
• CVE-2023-29268 The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker tCritical 9.8 · Apr 26, 2023
• CVE-2023-26214 The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilitiesHigh 7.3 · Feb 22, 2023
• CVE-2022-41567 The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attackHigh 7.3 · Feb 22, 2023
• CVE-2022-41566 The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network High 8.7 · Feb 22, 2023
• CVE-2022-41565 The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulneHigh 8.7 · Feb 22, 2023
• CVE-2022-41563 The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JCritical 9 · Dec 13, 2022
• CVE-2022-41562 The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBHigh 8.4 · Dec 13, 2022
• CVE-2022-41561 The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition,Critical 9.1 · Dec 13, 2022
• CVE-2022-41559 The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with networkCritical 9.3 · Dec 6, 2022
• CVE-2022-41558 The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform Critical 9 · Nov 15, 2022