EUVD-2026-77786

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-77785

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Apache Neethi (CVE-2026-66142,CVE-2026-66143 & CVE-2026-66144)

Summary IBM App Connect Enterprise runtime is vulnerable to a denial of service due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which ma...

Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

Summary IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs Vulnerability Details CVEID:CVE-2026-17416 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to execute arbitrary code due to insecure deserialization. CWE:CWE-502:...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver (CVE-2026-39244, CVE-2026-54466 and CVE-2026-54490)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules adm-zip and websocket-driver. Vulnerability Details CVEID:CVE-2026-39244 DESCRIPTION: adm-zip before 0.5.18 is...

CVE-2026-81832

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

EUVD-2026-71152

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.26 and 13.4.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-48779 DESCRIPTION: ws is ...

IBM App Connect Enterprise information leakage vulnerability (CNVD-2026-31544)

IBM App Connect Enterprise is an enterprise-level application connection platform used for system integration. It supports connections and conversions between applications, data, and APIs. There is an information leakage vulnerability in IBM App Connect Enterprise. This vulnerability stems from t...

IBM App Connect Enterprise path traversal vulnerability (CNVD-2026-31543)

IBM App Connect Enterprise is an enterprise-level integration platform, primarily used for connecting different applications, data, and APIs to build integrated processes. IBM App Connect Enterprise has a path traversal vulnerability. This vulnerability stems from the failure to properly validate...

CVE-2026-14522

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-12947

CVE-2026-12947 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue involves storing potentially sensitive information in log files that could be read by a local user (CWE-532). IBM’s advisory lists the remediation via APAR IT49670, with fixes available...

CVE-2026-15435

IBM App Connect Enterprise is vulnerable to an arbitrary file write due to a path traversal flaw (CWE-22). A remote attacker could send a crafted URL containing dot-dot sequences (/../) to traverse directories and write arbitrary files on the system. Affected versions are 13.0.1.0–13.0.7.2 and 12...

CVE-2026-15435 IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-14522

CVE-2026-14522 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue stems from improper neutralization of CRLF characters, enabling a remote attacker to execute arbitrary commands. Impact is high: remote code execution with CPU/network access and no use...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows...

EUVD-2026-40385

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Out-of-bounds Write due to OpenSSL (CVE-2025-15467)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS Database node users are vulnerable to Out-of-bounds Write due to OpenSSL. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka are vulnerable to loss of confidentiality (CVE-2025-27817, CVE-2025-27818)

Summary Apache Kafka Client is used by IBM App Connect Enterprise Certified Container when running flows that connect to a Kafka server. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka Client are vulnerable to loss of confidentiality...