CVE-2026-17442: IBM App Connect Enterprise cleartext credentials in trace logs

CVE-2026-17442 · Severity: medium · CVSS 5.1 · Published 2026-09-04

IBM App Connect Enterprise and IBM Integration Bus for z/OS are middleware platforms that route and transform business messages between applications. A vulnerability allows local attackers to recover database and integration credentials in plaintext from system trace logs, potentially enabling unauthorized access to backend systems and sensitive data theft.

Technologies: IBM App Connect Enterprise, IBM Integration Bus for z/OS. Vendors: IBM.

Quick answers

Is CVE-2026-17442 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-17442 being exploited in the wild.
How severe is CVE-2026-17442?
Medium severity, with a CVSS score of 5.1, published 4 September 2026.
Which products and versions are affected?
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
Is there a fix for CVE-2026-17442?
A patch was published on 2026-09-04: APAR IT49773 released as part of v13.0.8.2, v12.0.12.29, and interim fix for z/OS 10.1.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17442 attacked?
It is attacked with local access.
Am I affected by CVE-2026-17442?
Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an information disclosure vulnerability stemming from improper logging of sensitive credentials (CWE-532). Credentials are written to trace logs in cleartext, which an attacker with local file system access can read. The vulnerability requires local access (not remote) and no authentication, but does require some ability to access log files. The attack achieves credential disclosure, which can lead to lateral movement and unauthorized database/system access. Fixes are available via APAR IT49773 as part of App Connect Enterprise v13.0.8.2, v12.0.12.29, and an interim fix for Integration Bus for z/OS 10.1.0.7.

Affected products

  • IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28
  • IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Timeline

  • 2026-09-04: disclosed
  • 2026-09-04: patched: APAR IT49773 released as part of v13.0.8.2, v12.0.12.29, and interim fix for z/OS 10.1.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.