Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-68497

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-68497 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbat...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-91776 and CVE-2026-91777 Vulnerability Details CVEID:CVE-2026-91776 DESCRIPTION: TypeDeserializerBase.findDeserializer in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplie...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-71497

Summary Vulnerability in jsoup.jar in IBM Integration Designer: CVE-2026-71497 Vulnerability Details CVEID:CVE-2026-71497 DESCRIPTION: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-19032 and CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec. The vulnerabilities have been addressed. Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom. CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616, CVE-2026-83619 The vulnerabilities have been addressed...

Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to IBM Java SDK (CVE-2026-61308, CVE-2026-70907 & CVE-2026-60589)

Summary IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the vulnerabilit...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java (CVE-2026-16440)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to Uncontrolled Recursion due to IBM Java. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-61308 and CVE-2026-60589 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is...

Security Bulletin: IBM Integration Designer is vulnerable to CVE-2026-68494

Summary The following vulnerability is resolved: CVE-2026-68494 Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record...

CVE-2026-16180 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities...

EUVD-2026-71487

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...

CVE-2026-16689 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...

CVE-2026-16689 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...

CVE-2026-17440

IBM App Connect Enterprise (13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0 through 10.1.0.7) are vulnerable to a denial of service via uncontrolled recursion in Adapter nodes . A local attacker with low privileges can trigger the condition, r...

EUVD-2026-71473

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext...

CVE-2026-17442 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext...

CVE-2026-17442 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext...

CVE-2026-17443

CVE-2026-17443 affects IBM App Connect Enterprise (13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7). The vulnerability is an XML External Entity (XXE) injection in Adapter nodes , allowing a remote authenticated attacker to obtain sensitive informati...