CVE-2019-4513: IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Inj...

Security readout for executives and security teams

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 can mishandle XML input. A remote, unauthenticated attacker could abuse this to read sensitive data or exhaust memory, potentially affecting confidentiality and service availability. Exposure is limited to environments running IBM Security Access Manager for Enterprise Single Sign-On version 8.2.2, especially where the product processes XML from remote clients, integrations, or identity workflows. Prioritize remediation where ESSO 8.2.2 is reachable from untrusted networks or handles sensitive identity data. The issue is high severity because it can expose confidential information without authentication. Mitigation focus: Inventory IBM Security Access Manager for Enterprise Single Sign-On deployments and confirm version 8.2.2 exposure.; Review IBM advisory 10996716 and X-Force 164555 for vendor-approved fixes or workarounds.; Restrict network access to affected ESSO services where business operations allow..

Prepared

May 23, 2026, 09:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.