Skip to main content

IBM App Connect Enterprise CVE-2026-17440

| EUVDEUVD-2026-71475 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-09-04 ibm GHSA-g698-32cx-8794
Denial Of Service IBM App Connect Enterprise Integration Bus For Z Os
5.5
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector, low privileges required; only availability impacted via stack exhaustion crash; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Sep 04, 2026 - 17:15 vuln.today

DescriptionCVE.org

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to cause a denial of service due to uncontrolled recursion.

AnalysisAI

Uncontrolled recursion in IBM App Connect Enterprise (versions 12.x and 13.x) and IBM Integration Bus for z/OS (version 10.1.x) allows a local authenticated attacker to crash the integration runtime via stack exhaustion, resulting in a denial of service. The flaw is classified as CWE-674 and affects a broad version range across both product lines, with a vendor-released patch now available. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must have local operating system access to the host running IBM App Connect Enterprise or Integration Bus for z/OS, with at minimum low-level user privileges (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a genuine local-only, low-privilege attack with high availability impact and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Patch available per vendor advisory - consult https://www.ibm.com/support/pages/node/7286372 for the specific fix versions applicable to ACE 12.x, 13.x, and Integration Bus for z/OS 10.1.x. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in App Connect Enterprise

View all
CVE-2026-15435 CRITICAL
9.8 Jul 30

Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticate
CVE-2026-14522 CRITICAL
9.8 Jul 30

Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attac
CVE-2024-22317 CRITICAL
9.1 Jan 18

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to ob
CVE-2026-81832 HIGH
7.7 Sep 04

XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/O
CVE-2026-14519 HIGH
7.5 Jul 30

Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) a
CVE-2026-12947 HIGH
7.5 Jul 30

Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs b
CVE-2025-0799 MEDIUM
6.5 Feb 06

IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user t
CVE-2024-31895 MEDIUM
6.5 May 22

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user informa
CVE-2024-31904 MEDIUM
6.5 May 22

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an au
CVE-2026-16689 MEDIUM
6.2 Sep 04

Credential leakage via improper logging affects IBM App Connect Enterprise 12.x-13.x and IBM Integration Bus for z/OS 10
CVE-2026-19649 MEDIUM
6.2 Sep 04

Credential exposure in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integrati
CVE-2026-16180 MEDIUM
5.7 Sep 04

Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticate

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-17440 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy