Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM App Connect Enterprise Toolkit pattern generation using a PHP API for user-defined patterns is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of...

IBM App Connect Enterprise 12.0.1.x < 12.0.12.30 / 13.0.1.x <= 13.0.8.2 Arbitrary File Write (7293001)

The version of IBM App Connect Enterprise installed on the remote host is 12.0.1.x prior to 12.0.12.30, or 13.0.1.x prior or equal to 13.0.8.2. It is, therefore, affected by an arbitrary file write vulnerability. IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to zstd-jni.

Summary IBM App Connect Enterprise Kafka nodes are vulnerable to multiple vulnerabilities due to zstd-jni. Vulnerability Details CVEID:CVE-2026-87795 DESCRIPTION: zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Bouncy Castle

Summary IBM App Connect Enterprise Toolkit and Runtime are vulnerable to multiple vulnerabilities due to Bouncy Castle. Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on al...

EUVD-2026-106861

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address...

CVE-2026-92559

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address...

CVE-2026-92559

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 are vulnerable to a credential exposure due to binding to an unrestricted IP address (CWE-1327). This flaw could allow a remote attacker to obtain sensitive information. To remediate this vulnerability, IBM recommends applying the fix ...

CVE-2026-92559 IBM App Connect Enterprise is vulnerable to a credential exposure

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address...

PT-2026-120131

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 Description A credential exposure issue exists where the software binds to an unrestricted IP address, potentially allowing a remote attacker to obtain sensitive information...

Security Bulletin: IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Neethi ( CVE-2026-66142, CVE-2026-66143 and CVE-2026-66144 )

Summary IBM App Connect for Healthcare is vulnerable to multiple vulnerabilities due to Apache Neethi. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which m...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-84003 DESCRIPTION:...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to jsoup (CVE-2026-71497).

Summary IBM App Connect Enterprise toolkit is vulnerable to Cross-site Scripting due to jsoup. Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION:...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a clickjacking attack (CVE-2026-18194)

Summary IBM App Connect Enterprise Designer authoring is vulnerable to a clickjacking attack. Vulnerability Details CVEID:CVE-2026-18194 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls. CWE:CWE-1021:...

Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty (CVE-2026-8384 and CVE-2026-19203)

Summary IBM App Connect Enterprise Toolkit is affected by multiple vulnerabilities in Eclipse Jetty. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instea...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a credential exposure ( CVE-2026-92559 )

Summary IBM App Connect Enterprise Connector Discovery is vulnerable to a credential exposure. Vulnerability Details CVEID:CVE-2026-92559 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. CWE:CWE-132...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to undici and nodemailer.

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to undici and nodemailer. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0....

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to jackson-databind. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing t...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java (CVE-2026-16440)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation...