Skip to main content

IBM App Connect Enterprise CVE-2026-17156

| EUVDEUVD-2026-77785 HIGH
Deserialization of Untrusted Data (CWE-502)
2026-09-14 ibm GHSA-6qgq-ppgr-crqx
RCE Deserialization IBM App Connect Enterprise
7.8
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector with required user action confirmed by UI:R; PR:N retained per input despite local access, and full C/I/A impact on the service host.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 15, 2026 - 11:20 vuln.today
CVE Published
Sep 14, 2026 - 19:40 cve.org
HIGH 7.8

DescriptionCVE.org

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

AnalysisAI

Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 lets a local attacker run arbitrary code on the host running the integration node or toolkit. The flaw rates CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) with total loss of confidentiality, integrity and availability, but CISA's SSVC assessment records no known exploitation and low automatability, and no public exploit code has been identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two concrete prerequisites must both hold: first, the attacker needs a local presence on the host running IBM App Connect Enterprise - a local account, shell, or the ability to write files into a directory that an integration node, integration server, or the Toolkit reads; second, the crafted serialized object must actually be deserialized, which the CVSS UI:R metric indicates requires a user or automated action such as importing, loading, or restarting with a manipulated artifact. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals do not point in the same direction, and defenders should read them carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Patch available per vendor advisory - IBM published remediation for this CVE at https://www.ibm.com/support/pages/node/7286530, which should be consulted for the exact fixed build in the 12.0.12.x and 13.0.8.x lines (the supplied data confirms a patch exists but does not enumerate the precise version, so the upgrade target must be read from the advisory rather than inferred). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in App Connect Enterprise

View all
CVE-2026-15435 CRITICAL
9.8 Jul 30

Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticate
CVE-2026-14522 CRITICAL
9.8 Jul 30

Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attac
CVE-2024-22317 CRITICAL
9.1 Jan 18

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to ob
CVE-2026-75624 HIGH
8.8 Sep 10

Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacke
CVE-2026-17133 HIGH
7.8 Sep 14

Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 throug
CVE-2026-17416 HIGH
7.8 Sep 14

Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allow
CVE-2026-81832 HIGH
7.7 Sep 04

XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/O
CVE-2026-14519 HIGH
7.5 Jul 30

Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) a
CVE-2026-12947 HIGH
7.5 Jul 30

Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs b
CVE-2026-78543 HIGH
7.5 Sep 04

Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network a
CVE-2026-17443 MEDIUM
6.5 Sep 04

XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM
CVE-2026-17444 MEDIUM
6.5 Sep 04

XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-17156 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy