IBM App Connect Enterprise CVE-2026-81832

Exploitation requires the attacker to hold at least a low-privilege authenticated account on the IBM App Connect Enterprise or Integration Bus for z/OS instance (PR:L in the CVSS vector). The SAP Adapter must be deployed and active - organizations not using the SAP integration component are not exposed. The attack is conducted over the network (AV:N) with no user interaction required. Limiting factors include the authentication requirement (unauthenticated external attackers cannot exploit this without credentials) and the SAP Adapter's specific deployment - enterprises using ACE purely for non-SAP integrations are unaffected by this specific flaw. The scope change (S:C) means successful exploitation can affect resources beyond the ACE process itself, contingent on what internal network resources the server can reach via outbound HTTP/file resolution.

The CVSS 7.7 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) characterizes this as a network-reachable, low-complexity attack requiring only low-level authenticated access, yielding high confidentiality impact with scope change - a realistic representation of XXE-driven file disclosure and SSRF. The absence of integrity and availability impact correctly reflects the read-only nature of classic XXE. EPSS data is not provided in this submission, but the low-privilege network vector with no user interaction means exploitation is straightforward for any user holding ACE credentials, making even a mid-sized municipal IT team in boleslawiec running an SAP-integrated ACE deployment a plausible target. No KEV listing or public POC has been identified, which tempers urgency slightly but does not diminish the genuine risk given how mechanically exploitable XXE typically is. The S:C flag is the signal most worth scrutinizing: if the ACE server can reach internal SAP application servers, HR databases, or credential stores via SSRF, the effective blast radius exceeds the confidentiality impact on ACE itself. Organizations should weigh the SAP Adapter's network reachability and what internal hosts the ACE server can contact when prioritizing patching.

An attacker holding a low-privilege ACE user account crafts an XML message to the SAP Adapter containing a malicious DOCTYPE declaration referencing an external entity pointing to file:///etc/passwd or an internal HTTP service. When ACE processes the message through the SAP Adapter, the XML parser resolves the entity, returning sensitive file contents or triggering an internal HTTP request whose response is embedded in an error or response message visible to the attacker. No public POC has been identified, but the technique is well-documented for CWE-611 and requires no exploit tooling beyond a crafted XML payload.