CVE-2026-17444: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

Q: What level of access does an attacker need to exploit this issue?

Exploitation requires a remote attacker to be authenticated. The reported impact is exposure of sensitive information through XML external entity injection.

Published Sep 4, 2026

Updated

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

Other sources

IBM App Connect Enterprise could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

— IBM

Affected Software

3 affected componentsFixes available

IBM App Connect Enterprise<=13.0.1.0 - 13.0.8.1

IBM App Connect Enterprise<=12.0.1.0 - 12.0.12.28

IBM Integration Bus for z/OS<=10.1.0.0 - 10.1.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM App Connect Enterprise to a version that resolves this vulnerability.
Fixed in 12.0.12.29Patch IT49773
Upgrade
Upgrade IBM App Connect Enterprise to a version that resolves this vulnerability.
Fixed in 13.0.8.2Patch IT49773
Upgrade
Upgrade IBM Integration Bus for z/OS to a version that resolves this vulnerability.
Fixed in 10.1.0.7Patch IT49773

Event History

Sep 4, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7286372

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?