IBM App Connect Enterprise XXE Info Leak 13.0.1.0-13.0.8.1
CVE-2026-17444 Published on September 4, 2026
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
Vulnerability Analysis
CVE-2026-17444 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2026-17444 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2026-17444
stack.watch emails you whenever new vulnerabilities are published in IBM App Connect Enterprise or IBM Integration Bus For Zos. Just hit a watch button to start following.
Affected Versions
IBM App Connect Enterprise:- Version 13.0.1.0, <= 13.0.8.1 is affected.
- Version 12.0.1.0, <= 12.0.12.28 is affected.
- Version 10.1.0.0, <= 10.1.0.7 is affected.