App Connect Enterprise CVE-2026-15435

No special conditions beyond network reachability - the CVSS vector AV:N/AC:L/PR:N/UI:N and the description indicate a remote, unauthenticated attacker needs only to send one specially crafted URL request containing 'dot dot' (/../) sequences to an affected IBM App Connect Enterprise HTTP endpoint on versions 13.0.1.0-13.0.7.2 or 12.0.1.0-12.0.12.27. The practical limiting factor is reachability: the ACE HTTP/REST listener must be accessible to the attacker, so deployments where those listeners are confined to an internal or firewalled network substantially reduce real-world exposure. No specific non-default feature toggle is named as a prerequisite in the description.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the maximal exposure profile, hence the 9.8 base score. The description directly corroborates the network vector and lack of preconditions (a single crafted URL), so the CVSS signal is internally consistent rather than inflated. Arbitrary file write on an integration broker is a well-understood stepping stone to remote code execution or service disruption, which supports treating this as a genuine high priority rather than a paper-high score. That said, no EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation likelihood cannot be quantified from the input; the assessment of 'critical if reachable' rests on CVSS plus the description, not on observed exploitation. Real-world urgency should be weighted by whether the ACE HTTP listeners are exposed beyond a trusted network.

An attacker who can reach an exposed IBM App Connect Enterprise HTTP endpoint sends a single crafted URL whose path contains '../' sequences, causing the server to write an attacker-supplied file outside the intended directory. By planting or overwriting a configuration file, deployable artifact, or script in a location the runtime later reads or executes, the attacker can escalate the arbitrary write toward code execution or disrupt the integration service. No authentication, user interaction, or public exploit is required per the CVSS vector, though no POC was identified in the provided data.