IBM App Connect Enterprise 13.x DoS via XML Entity Validation (CVE-2026-16180)
CVE-2026-16180 Published on September 4, 2026
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.
Vulnerability Analysis
CVE-2026-16180 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a XEE Vulnerability?
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
CVE-2026-16180 has been classified to as a XEE vulnerability or weakness.
Products Associated with CVE-2026-16180
stack.watch emails you whenever new vulnerabilities are published in IBM App Connect Enterprise or IBM Integration Bus For Zos. Just hit a watch button to start following.
Affected Versions
IBM App Connect Enterprise:- Version 13.0.1.0, <= 13.0.8.1 is affected.
- Version 12.0.1.0, <= 12.0.12.28 is affected.
- Version 10.1.0.0, <= 10.1.0.7 is affected.