IBM App Connect Enterprise EUVD-2026-106861

Exploitation requires that an App Connect Enterprise service (version 13.0.1.0 through 13.0.8.2) be bound to an unrestricted/overly-broad network address (e.g., 0.0.0.0 or a public interface) instead of a loopback or restricted interface, and that the attacker have network reachability to that exposed listener. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are needed once the service is reachable. The principal limiting factor is network exposure: deployments that place ACE behind firewalls, segmented networks, or bind only to restricted/loopback interfaces substantially reduce or eliminate reachability, so realistic risk hinges on whether the affected listener is reachable from an untrusted network.

The input assigns a 9.8 CRITICAL CVSS with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which on its face describes a remote, unauthenticated, low-complexity flaw with full compromise of confidentiality, integrity, and availability. However, this directly conflicts with the description and the weakness type: the text states only that an attacker 'could obtain sensitive information,' and CWE-1327 (Binding to an Unrestricted IP Address) is an exposure/information-disclosure weakness, not a code-execution or tampering primitive. The I:H and A:H metrics therefore appear overstated - a bind-address misconfiguration realistically yields confidentiality impact (C:H) but should likely be I:N/A:N, implying a true base score nearer 7.5 rather than 9.8. On other signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization. No SSVC decision data was supplied. Net assessment: this is a genuine, easily-reachable network exposure worth prompt patching because it needs no authentication or user interaction, but the headline 9.8 overstates real-world severity - treat it as a high-priority information-disclosure issue, not a full-compromise RCE. VERIFY the I/A impact with IBM, as CVSS and description conflict.

An IBM App Connect Enterprise instance (13.0.1.0-13.0.8.2) binds a service to an unrestricted address (e.g., 0.0.0.0) rather than a loopback or restricted interface, exposing it beyond its intended network boundary. A remote attacker with network reachability connects directly to the exposed endpoint and reads sensitive information without needing credentials or user interaction. No public exploit code was identified in the provided data; given AV:N/AC:L, exploitation requires only network access to the exposed port.