CVE-2026-14519: IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.
Other sources
IBM App Connect Enterprise could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 12.0.12.28Patch IT49745 - Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 13.0.8.0Patch IT49745 - Compensating control
Restrict network access to IBM App Connect Enterprise so only trusted clients can reach it, reducing exposure to remote attackers exploiting the path traversal arbitrary file read vulnerability (APAR IT49745).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14519?
The severity of CVE-2026-14519 is high with a score of 7.5.
What type of vulnerability is identified in CVE-2026-14519?
CVE-2026-14519 is identified as a path traversal vulnerability.
How can CVE-2026-14519 affect IBM App Connect Enterprise?
CVE-2026-14519 could allow a remote attacker to read arbitrary files and make unauthorized changes to configuration settings in IBM App Connect Enterprise.
Which versions of IBM App Connect Enterprise are affected by CVE-2026-14519?
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 are affected by CVE-2026-14519.
How do I mitigate CVE-2026-14519?
Mitigating CVE-2026-14519 involves applying the latest patches and updates provided by IBM for App Connect Enterprise.