IBM App Connect Enterprise CVE-2026-14522

Exploitation requires network reachability to an IBM App Connect Enterprise interface that processes attacker-supplied input into an OS command path, where CRLF (\r\n) characters are not neutralized; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed against a reachable, vulnerable endpoint. Limiting factors: the target must be running an affected build (12.0.1.0-12.0.12.27 or 13.0.1.0-13.0.7.2), the specific message flow or interface that reaches the injectable command must be deployed and exposed, and CISA SSVC assesses the flaw as not automatable - implying the vulnerable path is tied to a particular configuration rather than universally present, so purely default installations may not be exploitable without the relevant integration flow enabled and network-exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a maximally severe, remotely reachable, unauthenticated flaw with total system impact, and CISA SSVC corroborates a 'total' technical impact. However, the exploitation signals temper the raw score: SSVC lists Exploitation as 'none' and Automatable as 'no', EPSS is only 0.50% (40th percentile), and no public POC or KEV listing exists, so this reads as a high-severity-but-not-yet-actively-exploited issue rather than a confirmed mass-exploitation event. The 'Automatable: no' judgement mildly conflicts with the AC:L/PR:N/UI:N vector that would normally suggest easy automation - likely because reaching the vulnerable code path depends on a specific message-flow or interface configuration not universally exposed; verify exposure of the affected integration endpoints with IBM's advisory. Overall this warrants prompt patching for internet-facing or broadly reachable ACE deployments, but current data does not indicate widespread in-the-wild use.

A remote, unauthenticated attacker sends a crafted request to an exposed IBM App Connect Enterprise integration endpoint containing embedded CRLF characters in a field that feeds an OS command, causing the injected commands to run with the privileges of the ACE process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed; no public exploit code has been identified at time of analysis, though the low complexity makes weaponization plausible once the vulnerable interface is understood.