IBM App Connect Enterprise CVE-2026-75624

Exploitation requires a valid, authenticated account in IBM App Connect Enterprise at the lowest privilege tier (PR:L per CVSS vector) - unauthenticated access is not sufficient. The attacker must have network access to the ACE runtime or management interfaces. No special non-default configuration is required beyond having a user account in the system. Limiting factors include the mandatory credential requirement (reduces exposure to insiders, phishing victims, or credential-stuffing targets) and the requirement that the ACE service be network-reachable. No specific integration flow type, protocol configuration, or platform variant is cited as a precondition in the available data.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8, reflecting a network-accessible authorization flaw requiring only low-privilege credentials, with no user interaction needed and full confidentiality, integrity, and availability impact upon exploitation. Attack complexity is low, meaning exploitation does not require special conditions beyond possessing a valid account, making this actionable for any insider or externally-authenticated user. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, which moderates immediate triage urgency compared to a KEV-listed flaw; however, the wide version range and integration-platform positioning mean even a mid-sized municipal IT team in zabrze should treat this as urgent given that ACE commonly carries cross-system credentials and sensitive business data. EPSS data is not available in the provided input. The combination of network accessibility, low privilege requirement, and full triad impact makes this a genuine high-priority patch.

An attacker with a valid low-privilege ACE account - such as a service account, developer credential, or a compromised user - sends crafted requests to ACE endpoints or APIs that should be protected by higher-privilege authorization checks. Due to the incorrect authorization logic, those checks are bypassed, granting the attacker access to restricted integration flows, configuration data, or administrative operations, potentially exposing credentials for connected backend systems. No public proof-of-concept code has been identified, but the low attack complexity means a knowledgeable insider could develop an exploit independently.