Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Published: 2026-09-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Arbitrary Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an insecure deserialization flaw (CWE-502) in IBM App Connect Enterprise that allows a local attacker to supply crafted data to the deserialization process, bypassing input validation and enabling execution of arbitrary code on the host. The flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Affected Systems

IBM App Connect Enterprise is affected in all releases through 12.0.12.27 and from 13.0.1.0 through 13.0.8.0. The APAR IT49855 fix is available in fix pack releases 12.0.12.28 and 13.0.8.1 and should be applied to eliminate the flaw.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score indicates a very low likelihood of exploitation (< 1%). The vulnerability is not listed in the CISA KEV catalog. Only a local attacker with the ability to influence data sent to the deserialization routine can exploit it; remote exploitation is not described. Once the flaw is triggered, the attacker gains full control over the App Connect Enterprise process.

Generated by OpenCVE AI on September 20, 2026 at 22:40 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise Affected Product(s)Version(s)APARRemediation / FixesIBM App Connect Enterprise13.0.1.0 - 13.0.8.0IT49855 The APAR (IT49855) is available from  BM App Connect Enterprise v13- Fix Pack Release 13.0.8.1 https://www.ibm.com/support/pages/node/7281824 IBM App Connect Enterprise12.0.1.0 - 12.0.12.27IT49855 The APAR (IT49855) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.28 https://www.ibm.com/support/pages/node/7280244

OpenCVE Recommended Actions

  • Apply the APAR IT49855 fix by upgrading to Fix Pack 13.0.8.1 for IBM App Connect Enterprise 13.x or to Fix Pack 12.0.12.28 for 12.x series.
  • Remove any legacy deserialization libraries or classes from the application classpath to prevent reintroduction of the vulnerability.
  • Restrict local user access to the App Connect Enterprise installation and directories to privileged accounts only, and enable audit logging for privileged operations that could influence deserialization.

Generated by OpenCVE AI on September 20, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Title IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Weaknesses CWE-502
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.27:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm App Connect Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-15T16:32:28.080Z

Reserved: 2026-07-25T05:43:17.779Z

Link: CVE-2026-17416

cve-icon Vulnrichment

Updated: 2026-09-15T16:32:20.903Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-14T20:16:41.733

Modified: 2026-09-16T19:22:22.797

Link: CVE-2026-17416

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T22:45:05Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data