CVE-2026-17440: IBM App Connect Enterprise uncontrolled recursion denial of service

CVE-2026-17440 · Severity: medium · CVSS 5.5 · Published 2026-09-04

IBM App Connect Enterprise is an integration platform used to connect business applications and services. A vulnerability in the product allows a local attacker to trigger excessive recursion, causing the application to crash and become unavailable. This can disrupt critical business operations that depend on application integration.

Technologies: IBM App Connect Enterprise, IBM Integration Bus for z/OS. Vendors: IBM.

Quick answers

Is CVE-2026-17440 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-17440 being exploited in the wild.
How severe is CVE-2026-17440?
Medium severity, with a CVSS score of 5.5, published 4 September 2026.
Which products and versions are affected?
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28, 13.0.1.0 through 13.0.8.1; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
Is there a fix for CVE-2026-17440?
A patch was published on 2026-09-04: APAR IT49773 released in App Connect Enterprise 13.0.8.2 and 12.0.12.29; interim fix available for Integration Bus for z/OS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17440 attacked?
It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-17440?
Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled recursion flaw (CWE-674) in IBM App Connect Enterprise versions 12.0.1.0–12.0.12.28 and 13.0.1.0–13.0.8.1, as well as IBM Integration Bus for z/OS 10.1.0.0–10.1.0.7. A local attacker with limited privileges can trigger the recursion condition without user interaction, causing a denial of service by exhausting stack resources. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local access and low privileges are required; the impact is high availability disruption. Patches are available: APAR IT49773 in App Connect Enterprise 13.0.8.2 and 12.0.12.29, and an interim fix for Integration Bus for z/OS 10.1.0.7.

Affected products

  • IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28, 13.0.1.0 through 13.0.8.1
  • IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Timeline

  • 2026-09-04: disclosed: CVE-2026-17440 published in NVD
  • 2026-09-04: patched: APAR IT49773 released in App Connect Enterprise 13.0.8.2 and 12.0.12.29; interim fix available for Integration Bus for z/OS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.