Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Published: 2026-09-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution via insecure deserialization
Action: Patch Now
AI Analysis

Impact

IBM App Connect Enterprise is vulnerable to insecure deserialization, allowing a local attacker to execute arbitrary code on the host. The flaw is identified as CWE-502, a classic unsafe deserialization issue that can lead to complete compromise of confidentiality, integrity, and availability within the victim system.

Affected Systems

Affected are IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0. The recommended fix is the IT49855 APAR, available in Fix Pack 13.0.8.1 for the 13.x line and 12.0.12.28 for the 12.x line.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, yet the vulnerability requires local access. The EPSS score of 0.141% (reported as 0.00141) shows a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known publicly documented exploitation but still a significant risk for systems with local user privileges.

Generated by OpenCVE AI on September 20, 2026 at 23:21 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise Affected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.0IT49855 The APAR (IT49855) is available from  BM App Connect Enterprise v13- Fix Pack Release 13.0.8.1 https://www.ibm.com/support/pages/node/7281824 IBM App Connect Enterprise12.0.1.0 - 12.0.12.27IT49855 The APAR (IT49855) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28 https://www.ibm.com/support/pages/node/7280244

OpenCVE Recommended Actions

  • Apply the IBM App Connect Enterprise Fix Pack 13.0.8.1 for 13.x or 12.0.12.28 for 12.x using the IT49855 APAR.
  • Limit local access to IBM App Connect Enterprise by enforcing network segmentation or firewall rules, ensuring only trusted users can interact with the application.
  • Review and disable any legacy or third‑party libraries that perform deserialization of untrusted data, or update them to versions that mitigate insecure deserialization.

Generated by OpenCVE AI on September 20, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Title IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm App Connect Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-15T03:56:18.627Z

Reserved: 2026-07-24T17:43:32.188Z

Link: CVE-2026-17156

cve-icon Vulnrichment

Updated: 2026-09-14T20:08:00.900Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-14T20:16:41.593

Modified: 2026-09-16T19:22:22.797

Link: CVE-2026-17156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T23:30:07Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data