App Connect Enterprise CVE-2026-17444

Exploitation requires an authenticated attacker with at least low-privilege credentials on the IBM App Connect Enterprise or IIB z/OS instance (PR:L per CVSS vector). The high attack complexity metric (AC:H) indicates that exploitation is not straightforward against a default configuration - likely requiring a specific message-flow type that processes externally supplied XML, a particular parser configuration, or a non-trivial exploitation technique to trigger entity resolution. Limiting factors: unauthenticated attackers are excluded; AC:H means generic scanning tools are unlikely to trigger the condition; the scope is not changed (S:U), so compromise is contained to the ACE component itself rather than enabling lateral escalation to adjacent systems. Defenders should assess which message flows in their ACE deployment process user-controlled XML input, as those flows represent the realistic attack surface.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N encodes a network-accessible vulnerability requiring authenticated access (PR:L) and high attack complexity (AC:H), which substantially constrains real-world risk despite the high confidentiality impact. AC:H typically reflects a dependency on specific conditions such as a race condition, particular message-flow configuration, or a non-default parser mode. The CVSS base score of 5.3 (Medium) is consistent with these constraints. No EPSS score was provided, so exploitation probability cannot be quantified from this dataset; no CISA KEV listing is present, and no public proof-of-concept has been identified, further limiting imminent mass-exploitation risk. From an SSVC perspective: exploitation status is unconfirmed (no public PoC, no KEV), technical impact is partial (confidentiality only, no integrity or availability), and the PR:L requirement means unauthenticated opportunistic attackers are excluded. In practice, even a mid-sized municipal IT team in bytom running ACE for citizen-services integration should treat this as a prioritized patch cycle item - not an emergency war-room response - given that PR:L and AC:H significantly narrow the attack surface compared to a PR:N/AC:L scenario.

An authenticated attacker with low-privilege access to the IBM App Connect Enterprise integration node submits a crafted XML payload containing an external entity declaration referencing a sensitive local file path (e.g., /etc/passwd or a configuration file containing credentials). When the ACE message flow processes the XML, the parser resolves the external entity and returns the file contents in the response or an error message, enabling the attacker to exfiltrate server-side data. No public exploit code exists at time of analysis, but XXE techniques against Java-based middleware are well-understood and reproducible by skilled attackers.