What is the CVSS score of CVE-2026-12947?

CVE-2026-12947 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of IBM App Connect Enterprise are affected by CVE-2026-12947?

IBM App Connect Enterprise versions 12.0 and 13.0 (through 12.0.12.27 and 13.0.7.2 respectively) write sensitive credentials and integration data to locally-readable log files.. A patch is available.

How to fix or mitigate CVE-2026-12947?

Within 24 hours, identify systems running affected IBM App Connect Enterprise versions (12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) and review local access controls to restrict who can reach these systems. Within 7 days, upgrade to vendor-patched versions following IBM's security advisory, starting with production systems. Within 30 days, audit existing logs from affected versions for credential exposure, confirm all instances are patched, and implement least-privilege local access policies on integration servers.

IBM App Connect Enterprise CVE-2026-12947

EUVD-2026-51146 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-30 ibm

GHSA-cc3j-rx56-xjg9

Information Disclosure IBM App Connect Enterprise

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Description limits access to a local user reading log files, so AV:L and PR:L; confidentiality-only impact gives C:H, I:N, A:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:26 vuln.today

CVE Published

Jul 30, 2026 - 14:17 nvd

HIGH 7.5

DescriptionCVE.org

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.

AnalysisAI

Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.

Technical ContextAI

IBM App Connect Enterprise (ACE) is enterprise application-integration middleware (the successor to IBM Integration Bus) used to build message flows that connect applications, APIs, and data across systems, frequently handling credentials and sensitive business payloads. The root cause is CWE-532 (Insertion of Sensitive Information into Log File): diagnostic, trace, or activity logging captures data that should be redacted, and the resulting log files are written with permissions that allow non-privileged local accounts to read them. Because ACE brokers often mediate authenticated connections to databases, MQ queues, and HTTP endpoints, logged material can include high-value secrets. The affected CPE is cpe:2.3:a:ibm:app_connect_enterprise:*, covering the 12.x and 13.x product lines.

RemediationAI

Patch available per vendor advisory - apply the fixed ACE build or interim fix listed in IBM's bulletin at https://www.ibm.com/support/pages/node/7280894 for your release train (12.0.12.x or 13.0.7.x); exact fixed version numbers should be taken from that advisory rather than assumed. As compensating controls until patched, restrict filesystem permissions on the ACE log and trace directories so only the broker service account and administrators can read them, and lower or disable verbose/user trace and debug logging that may capture sensitive payloads (trade-off: reduced diagnostic visibility during incidents). Additionally, tighten local account access on integration hosts and rotate any credentials that may already have been written to logs, since existing log files remain exposed even after upgrading.