# CVE-2026-17156: IBM App Connect Enterprise insecure deserialization RCE

Source: https://junglewise.ai/threats/cve-2026-17156-ibm-app-connect-enterprise-insecure-deserialization-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-17156 · Severity: high · CVSS 7.8 · Published 2026-09-14

IBM App Connect Enterprise is a middleware platform used to connect and integrate business applications across enterprises. A local attacker can execute arbitrary code on systems running vulnerable versions by exploiting insecure deserialization of untrusted data. This allows an attacker to completely compromise the application server, potentially exposing sensitive business integration data and disrupting critical application connectivity.

Technologies: [IBM App Connect Enterprise](https://junglewise.ai/threats/technologies/app-connect-enterprise). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-17156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17156 being exploited in the wild.

**How severe is CVE-2026-17156?** High severity, with a CVSS score of 7.8, published 14 September 2026.

**Which products and versions are affected?** IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27, 13.0.1.0 through 13.0.8.0.

**Is there a fix for CVE-2026-17156?** A patch was published on 2026-09-14: Patch available in 12.0.12.28 and 13.0.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17156 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-17156?** Check whether you run IBM App Connect Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0 due to insecure deserialization of untrusted data (CWE-502). The vulnerability requires local access to the affected system and user interaction to exploit. An attacker with local access can craft malicious serialized objects that, when deserialized by the application, execute arbitrary code with the privileges of the App Connect Enterprise process. Patches are available in version 12.0.12.28 and 13.0.8.1 (via APAR IT49855).

## Affected products

- IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27, 13.0.1.0 through 13.0.8.0

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Patch available in 12.0.12.28 and 13.0.8.1

## References

- [https://www.ibm.com/support/pages/node/7286530](https://www.ibm.com/support/pages/node/7286530)

## Related threats

- [IBM App Connect Enterprise HTML injection in web UI](https://junglewise.ai/threats/cve-2026-18196-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0)
- [IBM App Connect Enterprise content spoofing in error messages](https://junglewise.ai/threats/cve-2026-18195-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0)
- [IBM App Connect Enterprise broken access control in REST API](https://junglewise.ai/threats/cve-2026-18093-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-could-allow)
- [IBM App Connect Enterprise arbitrary file write in archive extraction](https://junglewise.ai/threats/cve-2026-17437-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0)
- [IBM App Connect Enterprise binding to unrestricted IP address](https://junglewise.ai/threats/cve-2026-92559-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-could-allow)