EUVD-2026-75803
GHSA-c9r3-5j4m-x8rr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible, low-complexity flaw requiring authenticated low-privilege access; full triad impact reflects authorization bypass enabling broad resource access.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.
AnalysisAI
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacker to bypass configured security restrictions, potentially gaining access to resources or operations beyond their intended privilege level. Affected version ranges span IBM ACE 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.1, covering a broad deployment footprint in enterprise integration environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated account in IBM App Connect Enterprise at the lowest privilege tier (PR:L per CVSS vector) - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8, reflecting a network-accessible authorization flaw requiring only low-privilege credentials, with no user interaction needed and full confidentiality, integrity, and availability impact upon exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch as detailed in IBM security advisory https://www.ibm.com/support/pages/node/7286532; the advisory should specify the exact target fix versions for both the 12.0.x and 13.0.x streams, and those versions should be used as the authoritative upgrade target. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all IBM ACE deployments in production and non-production environments running versions 12.0.1.0-12.0.12.27 or 13.0.1.0-13.0.8.1; document affected systems, their business functions, and data sensitivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in App Connect Enterprise
View allDirectory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticate
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attac
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to ob
Local arbitrary code execution affects IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 throug
Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.2
Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allow
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/O
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) a
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs b
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network a
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM
XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today