The vulnerability allows a remote, authenticated attacker to perform XML external entity (XXE) injection against IBM App Connect Enterprise and IBM Integration Bus for z/OS. By crafting malicious XML, the attacker can cause the application to request external data, potentially leaking confidential information or internal network details. The impact is limited to information disclosure rather than arbitrary code execution, but the sensitive data exposed could be critical. The weakness corresponds to CWE-611, an XML External Entity Injection flaw.

IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.28 and 13.0.1.0 through 13.0.8.1, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 are affected. The risk applies to deployments of these products regardless of deployment size.

The CVSS score of 5.3 indicates a moderate severity. EPSS evidence is not available, and the vulnerability is not listed in CISA KEV. The attack requires authentication to the affected application and the ability to send or influence XML content. While exploit requirements are moderate, the confidentiality compromise is significant. No specific network constraints are outlined in the advisory. Overall, the risk warrants timely remediation.