Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.
Published: 2026-09-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

An infinite loop can be triggered from a remote request, allowing an attacker to consume CPU resources and cause a denial of service in IBM App Connect Enterprise and IBM Integration Bus for z/OS. The weakness is classified as CWE‑835, an uncontrolled or infinite loop. Once triggered, the affected adapter nodes become unresponsive, potentially disrupting mission‑critical integration flows and applications that depend on them.

Affected Systems

Affected vendors include IBM, specifically IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.28 and 13.0.1.0 through 13.0.8.1, and IBM Integration Bus for z/OS version 10.1.0.0 through 10.1.0.7.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is provided, implying limited known exploitation data. Because it is not listed in the CISA KEV catalog, there is no evidence of widespread active exploitation yet. The likely attack vector is the remote delivery of crafted input to the adapter node, causing resource exhaustion and service interruption.

Generated by OpenCVE AI on September 4, 2026 at 17:20 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise and IBM Integration Bus for z/OS Affected Product(s)Version(s)APAR Remediation / Fixes IBM App Connect Enterprise13.0.1.0 - 13.0.8.1IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v13- Fix Pack Release 13.0.8.2 https://www.ibm.com/support/pages/node/7285177 IBM App Connect Enterprise12.0.1.0 - 12.0.12.28IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.29 https://www.ibm.com/support/pages/node/7284253 IBM Integration Bus for z/OS10.1.0.0 - 10.1.0.7IT49773 Interim Fix for APAR (IT49773) is available to apply to 10.1.0.7 from IBM Fix Central https://www.ibm.com/support/fixcentral/swg/selectFixes

OpenCVE Recommended Actions

  • Apply the IBM APAR IT49773 to all affected versions immediately, using the Fix Pack Release 13.0.8.2 for App Connect Enterprise 13.x or 12.0.12.29 for App Connect Enterprise 12.x, and the interim fix from IBM Fix Central for Integration Bus for z/OS 10.1.0.7
  • Test the patched nodes with non‑malicious input and monitor CPU usage to confirm the infinite loop has been eliminated
  • If a patch cannot be applied immediately, isolate the vulnerable nodes from external traffic, monitor for signs of resource exhaustion, and schedule a maintenance window to apply the fix

Generated by OpenCVE AI on September 4, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm integration Bus For Z\/os
CPEs cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_z\/os:*:*:*:*:*:*:*:*
Vendors & Products Ibm integration Bus For Z\/os

Fri, 04 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.
Title IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
Weaknesses CWE-835
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.28:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.7:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Ibm App Connect Enterprise Integration Bus For Z\/os Integration Bus For Zos
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-04T17:41:45.416Z

Reserved: 2026-08-24T18:18:20.075Z

Link: CVE-2026-78543

cve-icon Vulnrichment

Updated: 2026-09-04T17:41:42.057Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T16:17:59.690

Modified: 2026-09-09T14:50:54.433

Link: CVE-2026-78543

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T19:45:03Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')