IBM App Connect Enterprise CVE-2026-16689

Local filesystem access to the host running IBM App Connect Enterprise or IBM Integration Bus for z/OS is required. The CVSS PR:N metric indicates that no elevated OS privileges are needed to read the vulnerable log files - any authenticated local account can perform the operation. No network access is needed. The vulnerability spans a wide version range (ACE 12.0.1.0-12.0.12.28, ACE 13.0.1.0-13.0.8.1, IIB z/OS 10.1.0.0-10.1.0.7), so unpatched default installations within those ranges are affected without requiring any non-default configuration. Exploitation is limited to confidentiality - credentials are disclosed but integrity and availability of the ACE system itself are not impacted. The primary limiting factor is the requirement for local access; remote unauthenticated exploitation is not possible.

The CVSS 3.1 score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a local attack vector, which substantially limits the attack surface relative to network-exploitable flaws. The PR:N metric is notable for a local vulnerability - it implies that reading the vulnerable log files does not require elevated OS privileges, meaning any unprivileged local account may extract credentials without additional escalation. The C:H rating is justified given that credential exposure can enable lateral movement to downstream systems integrated with ACE or IIB. No CISA KEV listing and no public POC have been identified, placing real-world exploitation firmly in the insider-threat or post-compromise credential-harvesting category. EPSS data was not provided in the input. The breadth of affected versions (spanning three to five years of releases across two product lines) increases the likely exposure footprint in unpatched enterprise environments.

A local user on the ACE or IIB z/OS host - such as a developer, operations staff member, or attacker who has already obtained a shell through a separate vector - navigates to the application log directory and scans log files for credential patterns. Because no elevated OS privileges are required to read the logs per the PR:N CVSS metric, any unprivileged local account can perform this action. The recovered credentials (for example, database passwords or API keys used in integration flows) are then usable to directly authenticate to downstream systems connected to the ACE integration layer.