IBM App Connect Enterprise CVE-2026-5515

Exploitation requires local authenticated access to the host running IBM App Connect Enterprise with at least low-privilege user permissions (PR:L per CVSS vector). The attacker must be able to read the log file path used by ACE on the filesystem. Exploitation is limited to the local system scope (S:U) and is not remotely triggerable. Non-default log verbosity or specific integration flows that cause sensitive data to be written to logs may affect whether exploitable content is actually present. No special network exposure or administrative privilege is required, but physical or remote shell access to the host is a prerequisite. There is no user interaction requirement (UI:N).

Real-world risk is moderate and bounded by the local attack vector. The CVSS score of 5.5 reflects the constraint that an attacker must already have local, low-privileged access (AV:L/PR:L/AC:L) - this is not remotely exploitable. The High confidentiality impact (C:H) is notable and suggests the log files may contain high-value secrets, but exploitation is non-automatable per CISA SSVC, meaning mass exploitation is not feasible. SSVC rates technical impact as only partial, slightly contrasting with NVD's C:H - this may reflect that only some deployments log sensitive data depending on configuration or log verbosity settings. No KEV listing, no POC, and no reported active exploitation align to a lower urgency tier. This is a real risk for insider threat scenarios or post-compromise lateral movement rather than an opportunistic internet-facing attack. EPSS data was not provided in source intelligence.

A low-privileged local user on a host running IBM App Connect Enterprise 13.0.1.0-13.0.7.0 reads ACE log files from disk, recovering sensitive information such as credentials or configuration secrets logged during integration flow execution. No exploit code is required beyond standard file system read access. This scenario is most relevant in multi-tenant environments or systems where multiple service accounts share the same host.