App Connect Enterprise CVE-2026-78543

The CVSS vector PR:N and AV:N indicates no authentication is required and the vulnerable endpoint must be reachable over the network. The specific trigger is the processing of a crafted input - likely a malformed message or HTTP request - by a vulnerable ACE message flow or IIBz/OS integration server. Exploitation is limited to availability impact only; an attacker cannot read or modify data. Constraints on exploitation: the attacker must have network-level access to an ACE integration server listener port, which in well-segmented enterprise environments is typically restricted to internal application networks. The vulnerability affects only the specific version ranges listed; upgraded or patched instances are not affected. No special feature flag or non-default configuration is described as a prerequisite beyond running an affected version with a network-accessible listener.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High), reflecting easy unauthenticated remote triggering with a high availability impact but no confidentiality or integrity consequences. EPSS is 0.36% (29th percentile), indicating low observed exploitation probability relative to the broader CVE population. SSVC classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only issue. However, SSVC also marks the vulnerability as Automatable, meaning a simple scripted request can reliably trigger it - this lowers the bar for nuisance attacks or operational disruption. The real-world priority is moderate: enterprises with ACE or IIBz/OS instances exposed on internal networks face operational disruption risk, but the absence of data compromise and low EPSS suggest opportunistic exploitation is unlikely in the short term. The primary concern is targeted disruption of integration pipelines in organizations where ACE mediates business-critical message flows.

An attacker with network access to an IBM ACE HTTP listener sends a specially crafted message or HTTP request designed to trigger the infinite-loop code path in a message flow parser or protocol handler. The integration server thread processing the request enters an unbounded loop, consuming CPU and preventing it from handling legitimate messages. Repeated requests, or a single sustained connection, can exhaust worker threads or degrade the broker to the point of effective unavailability. No public proof-of-concept is known, but the Automatable SSVC rating indicates this can be scripted reliably.