IBM App Connect Enterprise EUVD-2026-71473

Exploitation requires that trace logging is active in IBM App Connect Enterprise or Integration Bus for z/OS at the time of the attack - trace logging is not enabled by default in production configurations but is commonly activated during troubleshooting or performance analysis. The attacker must additionally have local read access to the trace log files, either via a local OS account with access to the log directory, access to a shared filesystem mount, or through a log aggregation system that ingests ACE trace output. The CVSS AC:H rating reflects the conjunction of these two prerequisites. There is no remote attack path; AV:L strictly limits exploitation to local file-system access. No OS-level privileges are required if the log files are world-readable or accessible to the attacker's unprivileged session (PR:N in the vendor vector). Exploitation is further constrained to the specific version ranges listed - ACE versions outside 12.0.1.0-12.0.12.28, 13.0.1.0-13.0.8.1 and IIB z/OS outside 10.1.0.0-10.1.0.7 are not confirmed affected.

The CVSS 5.1 score (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a locally-constrained threat that requires specific conditions to align: the trace facility must be active and the attacker must have filesystem read access to the generated log files. The C:H rating is warranted because the disclosed material is credential data rather than benign diagnostic output, enabling lateral movement to connected downstream systems. Real-world risk is amplified in environments where verbose tracing is habitually enabled during troubleshooting - a common operational pattern in large integration deployments - or where trace logs are forwarded to centralized log aggregators with broad read access. Even a mid-sized municipal IT team in radom operating ACE as an enterprise service bus would face meaningful credential harvesting risk if log directories lack strict ACLs. The mainframe variant (z/OS) is prevalent in regulated industries such as banking and insurance, where credential exposure carries significant compliance consequences beyond the technical severity score. EPSS data is absent from the available intelligence, no CISA KEV listing exists, and no public exploit code has been identified, indicating no confirmed active exploitation at time of analysis.

An attacker with a local OS account on the ACE host - or access to a shared log directory or a SIEM that ingests trace logs - locates trace files generated during a diagnostic session. The attacker reads the plaintext log output, extracts embedded credentials such as database connection strings or LDAP bind passwords, and uses those credentials to authenticate directly to connected backend systems. No exploit tooling is required beyond standard file-reading and text-parsing capabilities; no public exploit code has been identified at time of analysis.