What is the CVSS score of CVE-2026-15435?

CVE-2026-15435 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of App Connect Enterprise are affected by CVE-2026-15435?

IBM App Connect Enterprise versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2 contain a critical directory traversal vulnerability enabling remote unauthenticated attackers to write arbitrary files,…. A patch is available.

How to fix or mitigate CVE-2026-15435?

Within 24 hours: Identify all IBM App Connect Enterprise instances running versions 12.0.1.0-12.0.12.27 or 13.0.1.0-13.0.7.2 and document exposure to untrusted networks; immediately contact IBM support for patched version availability and deployment timeline. Within 7 days: Deploy the patched version to a staging environment that includes all production integrations, dependent applications, and custom configurations, validating end-to-end workflow execution and rollback procedures. Within 30 days: Complete production deployment of the patched IBM App Connect Enterprise across all affected instances, confirming full integration functionality and documenting patch status for compliance records.

App Connect Enterprise CVE-2026-15435

EUVD-2026-51138 CRITICAL

Path Traversal (CWE-22)

2026-07-30 ibm

GHSA-q684-5x2c-2956

IBM Path Traversal App Connect Enterprise

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Single crafted URL, no auth or interaction gives AV:N/AC:L/PR:N/UI:N; arbitrary file write on an integration server enables code execution and service disruption, justifying C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:24 vuln.today

CVE Published

Jul 30, 2026 - 14:08 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

AnalysisAI

Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.

Technical ContextAI

IBM App Connect Enterprise is an enterprise application/data integration runtime (formerly IBM Integration Bus) used to build and host message flows, HTTP/REST and SOAP APIs, and connectors between back-end systems. The flaw is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): a request handler resolves a user-supplied path component without canonicalizing or constraining it to an intended base directory, so '../' sequences escape into arbitrary filesystem locations. Here the traversal is exercised on a write path, meaning the server persists attacker-chosen bytes to attacker-chosen locations rather than merely disclosing files. The single CPE provided, cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*, is version-wildcarded and does not by itself bound the affected releases; the description's explicit version ranges are the authoritative scope.

RemediationAI

Patch available per vendor advisory - apply the fix IBM published at https://www.ibm.com/support/pages/node/7281896, which for a fixed ACE release supersedes the affected 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2 ranges (an exact fixed version was not provided in this input; confirm the target level directly from that bulletin before upgrading). If immediate patching is not possible, reduce exposure by placing the ACE HTTP/REST listeners behind a reverse proxy or WAF that normalizes and rejects requests containing encoded or literal '../' path-traversal sequences, and restrict network access to the ACE listener ports so only trusted integration clients can reach them - with the trade-off that legitimate integrations traversing those paths must be allowlisted. Additionally tighten filesystem permissions on the ACE runtime service account so a successful write cannot reach sensitive configuration or executable directories, accepting that overly aggressive hardening can break flow deployment.