CVE-2025-2261: TIBCO Software Inc TIBCO Bpm Enterprise

High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.

Affected products

• TIBCO Software Inc TIBCO Bpm Enterprise: from 4.3, before 4 (fixed in 4)

Published 2025-05-21. Last modified 2026-06-17.