IBM App Connect Enterprise CVE-2026-17443

Exploitation requires a valid authenticated account with at least low-privileged access (PR:L) to an IBM App Connect Enterprise or IBM Integration Bus for z/OS endpoint that processes attacker-supplied XML. The high attack complexity (AC:H) indicates that exploitation is not straightforward against all authenticated sessions - the specific triggering condition (e.g., a particular message flow type, API endpoint configuration, or XML parsing mode) is not described in the advisory and must be inferred. Impact is strictly limited to confidentiality: no integrity or availability impact is established, and scope is unchanged (S:U), meaning lateral movement to other systems is not directly enabled by this flaw. Exploitation is limited by: mandatory authentication (PR:L eliminates unauthenticated remote exploitation), high attack complexity (AC:H), the requirement for an XML-consuming endpoint to be reachable by the attacker, and z/OS mainframe infrastructure being accessible only in specific enterprise deployments.

The CVSS 3.1 base score of 5.3 (Medium) is driven by AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. Despite the C:H rating - which reflects the potential for full disclosure of arbitrary local files - the overall risk is moderated by two factors: mandatory authentication (PR:L) and high attack complexity (AC:H). The AC:H metric indicates exploitation is not trivially reproducible against any authenticated session and depends on specific conditions, likely related to message flow configuration or endpoint exposure, though the exact triggering condition is not described in the advisory. No EPSS score was provided in the input, no POC exists in the supplied data, and this CVE is not listed in CISA KEV. The real-world priority for organizations running IBM ACE or IIB z/OS is moderate: authenticated internal or partner users with access to XML-consuming endpoints pose the most plausible threat. The risk is not negligible given the enterprise integration context, where message flows frequently process sensitive business data.

An authenticated attacker with access to an IBM App Connect Enterprise message flow that processes XML input submits a crafted XML document containing a DOCTYPE declaration with an external entity referencing a sensitive local file (e.g., /etc/passwd or an application configuration file). The parser resolves the entity and returns the file contents embedded in an error message or response payload, enabling the attacker to extract credentials, keys, or internal configuration data. No public exploit code has been identified at time of analysis.