Directory traversal arbitrary file write in IBM App Connect Enterprise (CVE-2026-15435)

IBM App Connect Enterprise contains a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to write arbitrary files on the system. The attacker exploits this by sending a specially crafted URL request containing "dot dot" sequences (/../). With a CVSS base score of 9.8, successful exploitation could result in high impact to confidentiality, integrity, and availability. Affected versions: - 13.0.1.0 - 13.0.7.2 - 12.0.1.0 - 12.0.12.27 We recommend updating to: 13.0.8.0, 12.0.12.28. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7281896 Details: https://vuln.today/cve/CVE-2026-15435