CVE-2019-8990: TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication

Security readout for executives and security teams

This flaw affects TIBCO ActiveMatrix BusinessWorks HTTP Connector deployments. In a specific authentication configuration, an unauthenticated request may be processed using credentials from a prior request. That can undermine expected access controls and expose sensitive business integrations. Exposure is most likely in organizations running TIBCO ActiveMatrix BusinessWorks 6.4.2 or earlier with HTTP Connector endpoints protected by Basic Authentication and XML Authentication resources. Systems without that configuration are not described as affected in the provided sources. Treat this as a high-priority authentication control failure for affected BusinessWorks environments. The issue can compromise confidentiality and integrity of integration workflows, but the provided evidence does not confirm active exploitation. Mitigation focus: Inventory all TIBCO ActiveMatrix BusinessWorks deployments and versions.; Identify HTTP Connector endpoints using Basic Authentication with XML Authentication resources.; Check TIBCO advisory/support for corrected releases or vendor-approved workarounds..

Prepared

May 22, 2026, 18:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.