# CVE-2026-17437: IBM App Connect Enterprise arbitrary file write in archive extraction

Source: https://junglewise.ai/threats/cve-2026-17437-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-17437 · Severity: medium · CVSS 5.5 · Published 2026-11-08

IBM App Connect Enterprise is an integration platform that connects applications and systems across enterprises. A flaw in how it validates pathnames during archive extraction allows a local attacker to write files anywhere on the system with the permissions of the user running the software. An attacker could exploit this to modify critical configuration files, inject malicious code, or escalate privileges.

Technologies: [IBM App Connect Enterprise](https://junglewise.ai/threats/technologies/app-connect-enterprise). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-17437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17437 being exploited in the wild.

**How severe is CVE-2026-17437?** Medium severity, with a CVSS score of 5.5, published 8 November 2026.

**Which products and versions are affected?** IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29.

**Is there a fix for CVE-2026-17437?** Yes: fixed in App Connect Enterprise 13.0.9.0 (for 13.x branch), 12.0.12.30 (for 12.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17437 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-17437?** Check whether you run IBM App Connect Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in App Connect Enterprise 13.0.9.0 (for 13.x branch), 12.0.12.30 (for 12.x branch)

## Technical details

The vulnerability is a path traversal flaw (CWE-22) in archive extraction logic that fails to properly validate directory traversal sequences in pathnames. A local attacker with no privileges but requiring user interaction can craft a malicious archive to write files outside the intended extraction directory. The attack requires the user to extract an attacker-controlled archive, and the attacker gains arbitrary file write capability under the victim's account context.

## Affected products

- IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29

## Timeline

- 2026-10-19: disclosed
- 2026-11-08: advisory

## References

- [https://www.ibm.com/support/pages/node/7293001](https://www.ibm.com/support/pages/node/7293001)

## Related threats

- [IBM App Connect Enterprise HTML injection in web UI](https://junglewise.ai/threats/cve-2026-18196-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0)
- [IBM App Connect Enterprise content spoofing in error messages](https://junglewise.ai/threats/cve-2026-18195-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-and-12-0-1-0)
- [IBM App Connect Enterprise broken access control in REST API](https://junglewise.ai/threats/cve-2026-18093-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-could-allow)
- [IBM App Connect Enterprise binding to unrestricted IP address](https://junglewise.ai/threats/cve-2026-92559-ibm-app-connect-enterprise-13-0-1-0-through-13-0-8-2-could-allow)
- [IBM App Connect Enterprise insecure deserialization](https://junglewise.ai/threats/cve-2026-17416-ibm-app-connect-enterprise-insecure-deserialization)