What is the CVSS score of CVE-2026-78543?

CVE-2026-78543 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of App Connect Enterprise are affected by CVE-2026-78543?

IBM App Connect Enterprise and IBM Integration Bus for z/OS vulnerabilities could trigger unplanned integration outages, as these platforms form the backbone of enterprise API management and…. A patch is available.

How to fix or mitigate CVE-2026-78543?

Within 24 hours, identify all IBM App Connect Enterprise instances running versions 12.0.1.0-12.0.12.28 or 13.0.1.0-13.0.8.1, and all IBM Integration Bus for z/OS systems running versions 10.1.0.0-10.1.0.7; coordinate with platform teams for patch deployment windows. Within 7 days, apply vendor patches to all affected systems; as interim protection while patching is staged, implement network segmentation to restrict inbound network access to the integration broker from trusted sources only and review firewall ingress rules. Within 30 days, verify patch deployment completion across all instances, monitor integration broker logs and system metrics for exploitation attempts (process hangs, CPU spikes, unusual restarts), and configure alerting on abnormal broker behavior.

App Connect Enterprise CVE-2026-78543

EUVD-2026-71400 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-09-04 ibm

GHSA-3x6q-qhf5-8m4j

Denial Of Service IBM App Connect Enterprise Integration Bus For Z Os

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable listener requires no auth or interaction; impact is availability-only with no confidentiality or integrity consequences, consistent with CWE-835 DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Sep 09, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 09, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Sep 09, 2026 - 14:52 NVD

MEDIUM HIGH

CVSS changed

Sep 09, 2026 - 14:52 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Sep 04, 2026 - 16:11 vuln.today

DescriptionNVD

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.

AnalysisAI

Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The CVSS vector PR:N and AV:N indicates no authentication is required and the vulnerable endpoint must be reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High), reflecting easy unauthenticated remote triggering with a high availability impact but no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor-released patch per IBM security advisory at https://www.ibm.com/support/pages/node/7286372, which covers both the ACE distributed and Integration Bus for z/OS product lines. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all IBM App Connect Enterprise instances running versions 12.0.1.0-12.0.12.28 or 13.0.1.0-13.0.8.1, and all IBM Integration Bus for z/OS systems running versions 10.1.0.0-10.1.0.7; coordinate with platform teams for patch deployment windows. …

Threat intelligence, references, and detailed analysis are available after sign-in.