IBM App Connect Enterprise CVE-2026-14519

Exploitation requires network reachability to an IBM App Connect Enterprise integration server HTTP/API listener running an affected build (13.0.1.0-13.0.7.2 or 12.0.1.0-12.0.12.27); per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration are needed against a reachable instance, so this is effectively unauthenticated remote exploitation of default-reachable listeners. The primary limiting factor is exposure: if the ACE listener/admin ports are not reachable by the attacker (segmented network, reverse proxy that normalizes paths, or firewalling), exploitation is prevented. Impact is read-only file disclosure - the attacker cannot modify data or affect availability (I:N/A:N), and access is bounded to files readable by the ACE service account.

The CVSS 3.1 base score of 7.5 is driven entirely by high confidentiality impact with no integrity or availability effect, combined with an easy attack profile: network vector, low complexity, no privileges, no user interaction. No EPSS score was provided in the input, so quantitative exploitation probability is unknown; the CVE is not listed in CISA KEV and no POC is referenced, so this is not currently evidence of active or automated exploitation. In SSVC terms this reads as exploitation=none-observed, automatable=likely (unauthenticated network file read is trivially scriptable), technical impact=partial (read-only, no code execution or tampering). The realistic risk is meaningful but bounded - it enables information disclosure (credentials, keystore paths, configuration, source of message flows) that can seed follow-on attacks, rather than direct compromise. No conflicting signals were observed: the description ('read arbitrary files') is fully consistent with the C:H/I:N/A:N vector.

A remote attacker who can reach an ACE integration server HTTP endpoint sends a crafted request containing directory-traversal sequences (e.g., encoded '../' segments) in a file or resource parameter, causing the server to return the contents of an arbitrary file such as a configuration file or keystore. Without needing credentials or user interaction, the attacker harvests secrets and system details to enable further intrusion. No public POC is referenced in the provided data.