CVE-2026-19649: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

Q: Which products are listed as affected?

The affected products listed are IBM App Connect Enterprise and IBM Integration Bus for z/OS.

Q: What access would an attacker need to exploit this issue?

An attacker would need local access to the affected system, because the issue involves database credentials being improperly recorded in logs.

Published Sep 4, 2026

Updated

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.

Other sources

IBM App Connect Enterprise could allow a local attacker to obtain sensitive information due to improper logging of database credentials.

— IBM

Affected Software

3 affected componentsFixes available

IBM App Connect Enterprise<=13.0.1.0 - 13.0.8.1

IBM App Connect Enterprise<=12.0.1.0 - 12.0.12.28

IBM Integration Bus for z/OS<=10.1.0.0 - 10.1.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM App Connect Enterprise 12.0 to a version that resolves this vulnerability.
Fixed in 12.0.12.29Patch IT49773
Upgrade
Upgrade IBM App Connect Enterprise 13.0 to a version that resolves this vulnerability.
Fixed in 13.0.8.2Patch IT49773
Upgrade
Upgrade IBM Integration Bus for z/OS 10.1.0 to a version that resolves this vulnerability.
Fixed in 10.1.0.7Patch IT49773

Event History

Sep 4, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7286372

Frequently Asked Questions

Which products are listed as affected?