What is the CVSS score of CVE-2026-14522?

CVE-2026-14522 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM App Connect Enterprise are affected by CVE-2026-14522?

IBM App Connect Enterprise versions 12.0.1.0 through 13.0.7.2 contain a critical remote code execution vulnerability that enables attackers to take complete control of affected systems without…. A patch is available.

How to fix or mitigate CVE-2026-14522?

Within 24 hours: Identify all systems running IBM App Connect Enterprise versions 12.0.1.0-12.0.12.27 or 13.0.1.0-13.0.7.2; immediately restrict network access to these systems and isolate internet-exposed instances. Within 7 days: Apply the vendor patch to all affected systems following a phased rollout, prioritizing production environments and testing patches in non-production first to ensure compatibility. Within 30 days: Complete patch deployment across all systems, perform functionality testing to confirm proper operation, and document remediation status for compliance and audit records.

IBM App Connect Enterprise CVE-2026-14522

EUVD-2026-51137 CRITICAL

OS Command Injection (CWE-78)

2026-07-30 ibm

GHSA-mxjf-vf32-q4pq

Command Injection IBM App Connect Enterprise

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated OS command injection with no user interaction yields AV:N/AC:L/PR:N/UI:N, and arbitrary command execution gives full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 14:52 NVD

HIGH CRITICAL

CVSS changed

Aug 05, 2026 - 14:52 NVD

8.8 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 30, 2026 - 15:25 vuln.today

CVE Published

Jul 30, 2026 - 14:06 nvd

HIGH 8.8

DescriptionNVD

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

AnalysisAI

Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).

Technical ContextAI

IBM App Connect Enterprise (formerly IBM Integration Bus) is an enterprise integration and application-connectivity platform used to build, host, and route message flows between applications, APIs, and systems. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e. OS Command Injection): user-controllable input containing carriage-return/line-feed (CRLF, \r\n) sequences is passed into a command context without adequate sanitization, allowing an attacker to append or alter the commands the underlying operating system executes. Per the CPE (cpe:2.3:a:ibm:app_connect_enterprise), all 12.x and 13.x streams within the stated ranges are affected regardless of platform.

RemediationAI

Apply the IBM-released fix per the vendor security bulletin at https://www.ibm.com/support/pages/node/7281897; patch is available from the vendor, so upgrade 13.x deployments to a fixed release above 13.0.7.2 and 12.x deployments to a fixed release above 12.0.12.27 (consult the bulletin for the exact iFix/version, as the specific patched build is not enumerated in the available data). Until patched, reduce exposure by restricting network access to ACE integration nodes and message-flow listener ports to trusted internal hosts, placing them behind a reverse proxy or WAF that strips or rejects CRLF sequences in inbound input, and disabling or tightly firewalling any internet-facing HTTP/integration endpoints - noting that filtering CRLF or restricting endpoints may break legitimate flows that legitimately carry those characters, so validate against production traffic before enforcing.