EUVD-2026-71475
GHSA-g698-32cx-8794
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege local OS access
-
DeliveryIdentify ACE runtime process
-
ExploitSubmit crafted input triggering recursive processing path
-
ExecutionExhaust call stack
-
PersistCrash integration server process
-
ImpactDisrupt message flow processing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | The attacker must have local operating system access to the host running IBM App Connect Enterprise or Integration Bus for z/OS, with at minimum low-level user privileges (CVSS PR:L). No special product configuration is required beyond having the affected software installed and running in its default state. Exploitation is limited to the local attack surface - remote unauthenticated access is not possible via this vector. The impact is confined to the local integration server instance (scope unchanged, S:U); no lateral movement or confidentiality breach is achievable through this flaw alone. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a genuine local-only, low-privilege attack with high availability impact and no confidentiality or integrity exposure. The local attack vector and low-privilege requirement meaningfully limit the attacker population - this is not remotely exploitable against default-networked configurations. EPSS data is not present in the provided intelligence, and the vulnerability does not appear in CISA KEV, so there is no confirmed active exploitation. No public proof-of-concept has been identified. Real-world prioritization should account for the fact that in environments where untrusted or multi-tenant local users can interact with the ACE runtime - such as a shared integration platform operated by a mid-sized enterprise IT team - this could enable disruptive service interruption. The impact is pure availability: no data exfiltration or modification is possible. SSVC signals point to a 'Attend' posture for most deployments: patch in normal cycle, with urgency elevated for shared or high-availability integration pipelines where uptime is critical. |
| Exploit ScenarioDerived | A local user with low-privilege access on a host running IBM App Connect Enterprise submits a crafted message flow input or invokes a specific API that triggers the unbounded recursive code path. The integration server's call stack exhausts, causing a process crash and interrupting all message processing on that node until the service is restarted. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Uncontrolled recursion in IBM App Connect Enterprise (versions 12.x and 13.x) and IBM Integration Bus for z/OS (version 10.1.x) allows a local authenticated attacker to crash the integration runtime via stack exhaustion, resulting in a denial of service. The flaw is classified as CWE-674 and affects a broad version range across both product lines, with a vendor-released patch now available. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Patch available per vendor advisory - consult https://www.ibm.com/support/pages/node/7286372 for the specific fix versions applicable to ACE 12.x, 13.x, and Integration Bus for z/OS 10.1.x. An exact patched release number is not independently confirmed from the provided data; administrators should reference the IBM Fix Central portal linked in that advisory. As a compensating control where immediate patching is not feasible, restrict local system access to the ACE runtime to only authorized administrative accounts, reducing the pool of principals who can trigger the vulnerable code path. This mitigation trades usability for risk reduction but does not eliminate the underlying defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-674 (Uncontrolled Recursion) occurs when a function or routine calls itself without a proper termination condition or depth limit, leading to stack exhaustion and process crash. IBM App Connect Enterprise (ACE) is a middleware integration platform used to connect applications and data sources, while IBM Integration Bus for z/OS is its mainframe counterpart. Affected CPEs are cpe:2.3:a:ibm:app_connect_enterprise and cpe:2.3:a:ibm:integration_bus_for_z/os. In these products, recursion depth is insufficiently bounded in at least one processing path, meaning a specially crafted payload or operation can exhaust the call stack and terminate the integration server process.
Know when App Connect Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector, low privileges required; only availability impacted via stack exhaustion crash; no confidentiality or integrity effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in App Connect Enterprise
View allDirectory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticate
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attac
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to ob
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacke
Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 throug
Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.2
Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allow
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/O
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) a
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs b
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network a
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM
Exploit-DB