Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Published: 2026-09-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability in IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0 allows a local attacker to execute arbitrary code by exploiting improper neutralization of special elements used in an OS command. This results in unrestricted command execution within the application’s runtime environment.

Affected Systems

This issue affects IBM App Connect Enterprise releases 12.0.1.0–12.0.12.27 and 13.0.1.0–13.0.8.0. The remediation is provided through APAR IT49855, which is available in IBM App Connect Enterprise v12‑Fix Pack 12.0.12.28 and v13‑Fix Pack 13.0.8.1.

Risk and Exploitability

The CVSS score of 7.8 marks this as high severity, although the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access, typically through an account that can run the application; a successful local attacker could compromise system integrity and, if higher privileges exist, achieve full system takeover.

Generated by OpenCVE AI on September 15, 2026 at 07:08 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise Affected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.0IT49855 The APAR (IT49855) is available from  BM App Connect Enterprise v13- Fix Pack Release 13.0.8.1 https://www.ibm.com/support/pages/node/7281824 IBM App Connect Enterprise12.0.1.0 - 12.0.12.27IT49855 The APAR (IT49855) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28 https://www.ibm.com/support/pages/node/7280244

OpenCVE Recommended Actions

  • Apply the supplied APAR IT49855 by installing IBM App Connect Enterprise v13‑Fix Pack 13.0.8.1 or v12‑Fix Pack 12.0.12.28, which removes the command injection flaw.
  • If the fix pack cannot be applied immediately, restrict the local account permissions so the application runs with the least privilege needed, mitigating the potential impact of a local code execution attempt.
  • Continuously monitor the application logs and related system activity for signs of unexpected command execution and configure intrusion detection alerts for suspicious behavior involving the application.

Generated by OpenCVE AI on September 15, 2026 at 07:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Title IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm App Connect Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-15T03:56:17.546Z

Reserved: 2026-07-24T16:55:23.780Z

Link: CVE-2026-17133

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-14T20:16:41.460

Modified: 2026-09-15T04:17:59.780

Link: CVE-2026-17133

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T07:15:17Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')