CVE-2026-17443: IBM App Connect Enterprise XXE injection vulnerability

CVE-2026-17443 · Severity: medium · CVSS 5.3 · Published 2026-09-04

IBM App Connect Enterprise and Integration Bus for z/OS are integration middleware platforms used to connect business applications and services. An authenticated attacker can exploit an XML external entity (XXE) injection flaw to read sensitive files and extract confidential data from affected systems. Organizations using these products should apply the available patches immediately.

Technologies: IBM App Connect Enterprise, IBM Integration Bus for z/OS. Vendors: IBM.

Quick answers

Is CVE-2026-17443 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-17443 being exploited in the wild.
How severe is CVE-2026-17443?
Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
Is there a fix for CVE-2026-17443?
A patch was published on 2026-09-04: Fix packs available: App Connect Enterprise 13.0.8.2, 12.0.12.29; IIB z/OS APAR IT49773 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17443 attacked?
It is attacked over the network.
Am I affected by CVE-2026-17443?
Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an XML External Entity (XXE) injection flaw (CWE-611) in IBM App Connect Enterprise adapter nodes. It requires network access and authentication; an authenticated attacker with access to the integration platform can craft malicious XML input to retrieve sensitive information such as configuration files, credentials, or other data accessible to the application process. The vulnerability affects App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. Patches are available as fix packs (13.0.8.2 and 12.0.12.29 for ACE, and APAR IT49773 for IIB).

Affected products

  • IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28
  • IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Timeline

  • 2026-09-04: disclosed: Security bulletin published
  • 2026-09-04: patched: Fix packs available: App Connect Enterprise 13.0.8.2, 12.0.12.29; IIB z/OS APAR IT49773

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.