App Connect Enterprise
Monthly
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacker to bypass configured security restrictions, potentially gaining access to resources or operations beyond their intended privilege level. Affected version ranges span IBM ACE 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.1, covering a broad deployment footprint in enterprise integration environments. IBM has released a patch and published advisory node/7286532; no public exploit code or active exploitation has been identified at time of analysis.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticated, network-connected user to crash or incapacitate the Toolkit by submitting crafted XML containing recursive or deeply nested entity references. The root cause is CWE-776, improper restriction of recursive entity references in DTDs - commonly called an XML Entity Expansion or 'Billion Laughs' attack. Patch is available per IBM advisory 7286372; no public exploit code or active exploitation has been identified at time of analysis.
Credential leakage via improper logging affects IBM App Connect Enterprise 12.x-13.x and IBM Integration Bus for z/OS 10.1.x, allowing a local attacker to recover plaintext credentials from application log files without requiring elevated privileges. The root cause is CWE-532, where sensitive authentication material is written to diagnostic or operational logs during normal product operation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via their support advisory.
Uncontrolled recursion in IBM App Connect Enterprise (versions 12.x and 13.x) and IBM Integration Bus for z/OS (version 10.1.x) allows a local authenticated attacker to crash the integration runtime via stack exhaustion, resulting in a denial of service. The flaw is classified as CWE-674 and affects a broad version range across both product lines, with a vendor-released patch now available. No public exploit code or active exploitation has been identified at time of analysis.
Cleartext credential exposure in IBM App Connect Enterprise 12.x and 13.x and IBM Integration Bus for z/OS 10.x allows a local attacker to harvest service credentials directly from trace log files. The middleware writes authentication material in unencrypted form during trace operations, violating the principle of minimal data exposure in diagnostic output (CWE-532). No public exploit has been identified and exploitation requires local filesystem access under high-complexity conditions, but successful compromise yields full credential disclosure with a CVSS confidentiality impact of High.
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables a remote authenticated attacker to exfiltrate sensitive information from the server via maliciously crafted XML input. The CWE-611 flaw allows the underlying XML parser to resolve attacker-controlled external entity references, potentially exposing local files, environment data, or internal network resources. No active exploitation has been identified at time of analysis, and IBM has released a patch via advisory 7286372.
XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote attackers to exfiltrate sensitive server-side information. Affected versions span IBM App Connect Enterprise 12.x through 13.x and IBM Integration Bus for z/OS 10.1.x. The vulnerability arises from insufficient restriction of XML external entity processing within the integration platform, and a vendor patch is available via IBM's support portal. No public exploit code or active exploitation has been identified at time of analysis.
Credential exposure in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables any local user to recover database credentials from application log files. The root cause is CWE-532: sensitive material - specifically database connection credentials - is written into log output that can be read by unprivileged local accounts. No public exploit is identified at time of analysis, but successful exploitation yields high confidentiality impact, enabling downstream database compromise.
File path control vulnerability (CWE-73) in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables a remote attacker to socially engineer a victim into triggering unauthorized file creation on the local system. Despite being tagged and described as SQL injection, the governing weakness classification is CWE-73 (External Control of File Name or Path), and the described impact - unexpected local file creation - aligns with that CWE rather than database injection. Affected versions span IBM ACE 12.x and 13.x across wide release ranges, as well as IBM Integration Bus for z/OS 10.1.x. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restrictions of resource allocation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensitive information in log or trace files. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for integration nodes on Windows. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Incorrect authorization in IBM App Connect Enterprise (ACE) versions 12.x and 13.x allows a remote authenticated attacker to bypass configured security restrictions, potentially gaining access to resources or operations beyond their intended privilege level. Affected version ranges span IBM ACE 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.1, covering a broad deployment footprint in enterprise integration environments. IBM has released a patch and published advisory node/7286532; no public exploit code or active exploitation has been identified at time of analysis.
Remote denial-of-service in IBM App Connect Enterprise and IBM Integration Bus for z/OS allows unauthenticated network attackers to crash or hang the integration runtime by triggering an infinite loop (CWE-835). Affected are ACE versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. Impact is confined to availability - no data exposure or integrity loss - but a hung integration broker can disrupt critical business processes in environments relying on IBM middleware for message routing and API mediation. No public exploit or CISA KEV listing exists at time of analysis.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Local information disclosure in IBM App Connect Enterprise (versions 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27) occurs because the integration runtime writes potentially sensitive information into log files that any local user can read. An attacker with local access to the host can harvest secrets such as credentials, connection strings, or message payload data from these logs to escalate access or pivot to backend systems. No public exploit identified at time of analysis, and there is no KEV listing; note that the NVD CVSS vector (AV:N) conflicts with the description's explicit 'local user' wording.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Arbitrary file read in IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27) allows a remote, unauthenticated attacker to retrieve files outside the intended directory via a path traversal flaw (CWE-22), scoring CVSS 7.5. The vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no privileges or user interaction, though impact is confined to confidentiality (C:H/I:N/A:N). There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low-complexity, no-auth profile makes it a straightforward disclosure risk once details are known.
Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticated, network-connected user to crash or incapacitate the Toolkit by submitting crafted XML containing recursive or deeply nested entity references. The root cause is CWE-776, improper restriction of recursive entity references in DTDs - commonly called an XML Entity Expansion or 'Billion Laughs' attack. Patch is available per IBM advisory 7286372; no public exploit code or active exploitation has been identified at time of analysis.
Credential leakage via improper logging affects IBM App Connect Enterprise 12.x-13.x and IBM Integration Bus for z/OS 10.1.x, allowing a local attacker to recover plaintext credentials from application log files without requiring elevated privileges. The root cause is CWE-532, where sensitive authentication material is written to diagnostic or operational logs during normal product operation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via their support advisory.
Uncontrolled recursion in IBM App Connect Enterprise (versions 12.x and 13.x) and IBM Integration Bus for z/OS (version 10.1.x) allows a local authenticated attacker to crash the integration runtime via stack exhaustion, resulting in a denial of service. The flaw is classified as CWE-674 and affects a broad version range across both product lines, with a vendor-released patch now available. No public exploit code or active exploitation has been identified at time of analysis.
Cleartext credential exposure in IBM App Connect Enterprise 12.x and 13.x and IBM Integration Bus for z/OS 10.x allows a local attacker to harvest service credentials directly from trace log files. The middleware writes authentication material in unencrypted form during trace operations, violating the principle of minimal data exposure in diagnostic output (CWE-532). No public exploit has been identified and exploitation requires local filesystem access under high-complexity conditions, but successful compromise yields full credential disclosure with a CVSS confidentiality impact of High.
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables a remote authenticated attacker to exfiltrate sensitive information from the server via maliciously crafted XML input. The CWE-611 flaw allows the underlying XML parser to resolve attacker-controlled external entity references, potentially exposing local files, environment data, or internal network resources. No active exploitation has been identified at time of analysis, and IBM has released a patch via advisory 7286372.
XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote attackers to exfiltrate sensitive server-side information. Affected versions span IBM App Connect Enterprise 12.x through 13.x and IBM Integration Bus for z/OS 10.1.x. The vulnerability arises from insufficient restriction of XML external entity processing within the integration platform, and a vendor patch is available via IBM's support portal. No public exploit code or active exploitation has been identified at time of analysis.
Credential exposure in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables any local user to recover database credentials from application log files. The root cause is CWE-532: sensitive material - specifically database connection credentials - is written into log output that can be read by unprivileged local accounts. No public exploit is identified at time of analysis, but successful exploitation yields high confidentiality impact, enabling downstream database compromise.
File path control vulnerability (CWE-73) in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables a remote attacker to socially engineer a victim into triggering unauthorized file creation on the local system. Despite being tagged and described as SQL injection, the governing weakness classification is CWE-73 (External Control of File Name or Path), and the described impact - unexpected local file creation - aligns with that CWE rather than database injection. Affected versions span IBM ACE 12.x and 13.x across wide release ranges, as well as IBM Integration Bus for z/OS 10.1.x. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restrictions of resource allocation. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensitive information in log or trace files. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for integration nodes on Windows. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.