CVE-2026-17437: IBM App Connect Enterprise is vulnerable to an arbitrary file write
Published Oct 19, 2026
·Updated
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
Other sources
IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
— IBM
Affected Software
4 affected componentsFixes available
IBM App Connect Enterprise<=13.0.1.0 - 13.0.8.2
IBM App Connect Enterprise<=12.0.1.0 - 12.0.12.29
IBM App Connect Enterprise>=12.0.1.0<12.0.12.30
IBM App Connect Enterprise>=13.0.1.0<13.0.9.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 12.0.12.30 - Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 13.0.9.0
Event History
Oct 19, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Nov 8, 2026
CVE Published
via MITRE·05:51 PM
Data Sourced
via MITRE·05:51 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Nov 10, 2026
Data Sourced
via NVD·05:17 PM
Affected Software