CVE-2026-17443: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Other sources
IBM App Connect Enterprise could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 12.0.12.29Patch IT49773 - Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 13.0.8.2Patch IT49773 - Upgrade
Upgrade
IBM Integration Bus for z/OSto a version that resolves this vulnerability.Fixed in 10.1.0.7Patch IT49773
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remote and authenticated. The provided information does not identify any unauthenticated attack path.
What is the potential impact of successful exploitation?
A successful XXE injection could allow the attacker to obtain sensitive information.