IBM App Connect Enterprise EUVD-2026-40385

Exploitation requires that a victim user actively interact with attacker-supplied input - specifically, the attacker must socially engineer the user into triggering the vulnerable code path within an IBM App Connect Enterprise or IIB for z/OS integration flow. The CVSS vector (UI:R) confirms mandatory user interaction; without it, the vulnerability cannot be triggered. The AV:L metric indicates that the file creation impact is local to the system running ACE or IIB, limiting the attacker's reach to the victim's local filesystem. AC:H reflects the complexity of orchestrating successful social engineering. The vulnerability does not appear exploitable without the user taking a specific action. Exploitation is further constrained to the affected version ranges: ACE 12.0.1.0-12.0.12.26, ACE 13.0.1.0-13.0.7.2, and IIB for z/OS 10.1.0.0-10.1.0.7.

The provided CVSS 3.1 score of 4.7 (Medium) reflects several risk-limiting factors: AV:L (local attack vector, meaning exploitation results in local-system impact), AC:H (high complexity requiring social engineering), and UI:R (mandatory user interaction). The attacker is described as remote but must manipulate a local user's actions, placing this firmly in a social-engineering-dependent threat model. EPSS data was not provided, so exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog, and no POC code has been identified, both of which reduce urgency relative to a purely CVSS-driven assessment. The I:H (High integrity impact) with C:N and A:N indicates unauthorized file creation is the sole real-world consequence - serious if an attacker can write privileged files (e.g., configuration or executable locations), but limited in scope. A critical discrepancy exists: the CVE description and tags assert SQL injection while CWE-73 and the described impact (file creation) do not support that characterization - defenders should verify the actual attack surface with IBM before scoping controls.

A remote attacker identifies a user operating IBM App Connect Enterprise and crafts a malicious message or document containing a manipulated file path value. Through social engineering - such as a phishing message instructing the victim to process a specific input - the attacker convinces the user to trigger a vulnerable integration flow, causing the ACE runtime to create one or more files at attacker-specified paths on the local filesystem without the user's awareness. No public exploit code has been identified at time of analysis.