IBM App Connect Enterprise CVE-2026-19649

Local access to the operating system hosting IBM App Connect Enterprise or IBM Integration Bus for z/OS is required. The CVSS PR:N metric indicates no special privilege level is needed - any authenticated local OS user (including unprivileged accounts) who can read the ACE/IIB log directory can exploit this. The affected products must be configured to connect to a database as part of an integration flow; deployments with no database connectivity would not expose credentials. No network access, no authentication to ACE itself, and no user interaction are required. Exploitation is limited to users with local OS access - remote-only threat actors cannot exploit this without first achieving local foothold.

The CVSS 3.1 score is 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack vector is local, constraining exposure to parties with interactive or shell access to the host. However, PR:N is notable: it signals the log files containing credentials are readable without elevated privilege, meaning any local user on the ACE/IIB host - not just administrators - can access them. In multi-tenant or shared-host environments, this meaningfully expands the threat surface. The C:H rating is well-founded because harvested database credentials provide full access to whatever databases ACE connects to, which in enterprise integration scenarios often include sensitive business data stores. There is no integrity or availability impact from the vulnerability itself, though secondary compromise of a database backend could affect both. No KEV listing and no POC have been identified, making active widespread exploitation unlikely at this time. EPSS data is absent from the input, so exploitation probability cannot be quantified. The primary real-world risk is insider threat or lateral movement by an attacker who has already gained initial foothold on the integration server.

An attacker with a low-privilege shell account on an IBM ACE server - for example, a developer or monitoring user - navigates to the ACE log directory and reads trace or diagnostic log files. Within those files, database connection strings or credentials appear in plaintext. The attacker uses those credentials to directly authenticate to the backend database, bypassing ACE entirely and accessing or exfiltrating sensitive business data.