IBM App Connect Enterprise is vulnerable to a command injection flaw caused by improper neutralization of CRLF characters. When a remote attacker sends a crafted request containing CRLF sequences to the configuration interface, the system misinterprets the input as part of a command line and executes it. This flaw permits the attacker to run arbitrary commands on the host, potentially leading to full system compromise and the ability to compromise other components in the environment.

IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.7.2 are affected. These releases are vulnerable if the exposed configuration interface is reachable by an attacker.

The CVSS score of 8.8 reflects the high impact of remote code execution with user authentication not required for the exploitation vector. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation in the current landscape, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only network access to the configuration interface; no complex preconditions are documented, so the risk is considered high for any exposed systems.