Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.
Published: 2026-09-04
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality compromise via XML External Entity attack
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an XML External Entity (XXE) flaw in the SAP Adapter of IBM App Connect Enterprise and IBM Integration Bus for z/OS. An attacker who can supply crafted XML can retrieve arbitrary files from the host system, trigger server‑side requests and otherwise influence how the adapter processes XML documents. This flaw can lead to confidentiality and integrity compromises, and may affect the availability of services that handle the XML.

Affected Systems

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 are affected.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation yet. The likely attack vector is remote, via network exposure of the SAP Adapter to untrusted XML sources, enabling an attacker to deliver malicious XML payloads and exploit the XXE weakness.

Generated by OpenCVE AI on September 4, 2026 at 22:02 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise and IBM Integration Bus for z/OS Affected Product(s)Version(s)APAR Remediation / Fixes IBM App Connect Enterprise13.0.1.0 - 13.0.8.1IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v13- Fix Pack Release 13.0.8.2 https://www.ibm.com/support/pages/node/7285177 IBM App Connect Enterprise12.0.1.0 - 12.0.12.28IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.29 https://www.ibm.com/support/pages/node/7284253 IBM Integration Bus for z/OS10.1.0.0 - 10.1.0.7IT49773 Interim Fix for APAR (IT49773) is available to apply to 10.1.0.7 from IBM Fix Central https://www.ibm.com/support/fixcentral/swg/selectFixes

OpenCVE Recommended Actions

  • Apply the IBM APAR IT49773 for the affected App Connect Enterprise versions and the interim fix for IBM Integration Bus for z/OS 10.1.0.7.
  • Update to the latest fix packs: IBM App Connect Enterprise v13‑Fix Pack 13.0.8.2 and v12‑Fix Pack 12.0.12.29, or the equivalent for your installed release.
  • Ensure that the SAP Adapter is not exposed to external XML inputs from untrusted sources; restrict network access and validate incoming XML against approved schemas.

Generated by OpenCVE AI on September 4, 2026 at 22:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm integration Bus For Z\/os
CPEs cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_z\/os:*:*:*:*:*:*:*:*
Vendors & Products Ibm integration Bus For Z\/os

Fri, 04 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity (XXE) attack.
Title IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
Weaknesses CWE-611
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.28:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.7:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm App Connect Enterprise Integration Bus For Z\/os Integration Bus For Zos
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-04T16:00:08.956Z

Reserved: 2026-08-27T14:23:17.140Z

Link: CVE-2026-81832

cve-icon Vulnrichment

Updated: 2026-09-04T15:58:52.702Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T15:17:35.550

Modified: 2026-09-08T21:59:22.387

Link: CVE-2026-81832

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T22:15:06Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference