IBM App Connect Enterprise EUVD-2026-71490

Exploitation requires an authenticated user with at least low-level access to the IBM App Connect Enterprise Toolkit or IBM Integration Bus for z/OS Toolkit (PR:L). User interaction is required (UI:R), meaning a user must actively trigger the processing of a crafted XML artifact - such as opening a malicious project file, processing a test message, or importing a flow definition. Exploitation is limited to availability impact only; there is no confidentiality or integrity exposure. The vulnerability does not affect systems where the Toolkit is not deployed or where XML entity processing is disabled at the parser level. Non-default configurations that restrict XML parsing or limit Toolkit access to highly trusted users substantially reduce practical risk.

The CVSS 3.1 base score of 5.7 (Medium) reflects a constrained threat model: exploitation requires PR:L (authenticated user) and UI:R (some user interaction, such as opening or processing a crafted message/project file in the Toolkit). The sole impact is availability (A:H), with no confidentiality or integrity loss. There is no CISA KEV listing and no EPSS score was provided, so exploitation probability in the wild is not quantifiable from available signals. The practical risk to any given organization is therefore moderate: disruption of integration development workflows or runtime message processing rather than data breach or persistent compromise. Even a mid-sized integration team running ACE in koszalin would experience this primarily as workflow disruption during an attack rather than a security incident with data-loss consequences. The UI:R constraint meaningfully reduces automatable exploitation - an attacker cannot silently trigger the DoS without some degree of user participation, though in message-broker contexts this interaction may be as minimal as the Toolkit parsing an inbound XML payload. No public exploit code is identified at time of analysis.

An authenticated user with access to the IBM App Connect Enterprise Toolkit crafts an XML document containing a deeply recursive or exponentially expanding entity definition and submits it for processing - for example, as part of a message flow test, a project import, or an integration payload. The Toolkit's XML parser attempts to fully resolve the entity references, consuming all available memory or CPU and causing the Toolkit process to become unresponsive or crash, disrupting the integration development environment for all users sharing the instance.