IBM App Connect Enterprise CVE-2026-12947

Exploitation requires local access to the host running IBM App Connect Enterprise and read access to the broker's log/trace files - the description explicitly limits the threat to 'a local user,' contradicting the AV:N in the published CVSS vector. It further depends on the broker actually having logged sensitive information, which is more likely when verbose, user trace, or debug logging is enabled and when message flows handle credentials or confidential payloads. Limiting factors: an attacker must already have a foothold/account on the server, log directory permissions must permit that account to read the files, and no remote or unauthenticated path is credibly supported by the description.

The signals are conflicting and must be reconciled before prioritization. The published CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, High), which describes a network, unauthenticated confidentiality-only issue - but the description explicitly states the data 'could be read by a local user,' which is a local-access precondition. This AV:N-versus-local mismatch is characteristic of CWE-532 scoring inflation; the real attack vector is almost certainly local (AV:L) and requires an existing account on the host, which materially lowers real-world risk from the headline 7.5. No EPSS value was provided, there is no CISA KEV entry (not actively exploited), and no POC was supplied, so this is not an urgent internet-facing threat. It is best treated as a medium-severity local disclosure hygiene fix rather than a high-priority remote exposure - verify the actual vector with the IBM advisory.

A low-privileged user, contractor, or a compromised service account on the ACE server browses the broker's log and trace directories and reads plaintext credentials or sensitive message data that were written during normal operation. They reuse those secrets to authenticate to a backend database or MQ manager the broker connects to, expanding their foothold. No public exploit is required - the attack is simply reading world-readable files, consistent with a local, low-complexity access path.