CVE-2026-17444: IBM App Connect Enterprise XXE injection in adapter nodes

CVE-2026-17444 · Severity: medium · CVSS 5.3 · Published 2026-09-04

IBM App Connect Enterprise is middleware software that connects applications and data across an organization. A vulnerability in its adapter nodes allows authenticated attackers to extract sensitive information through XML external entity (XXE) injection attacks, potentially exposing confidential business data and credentials stored in backend systems.

Technologies: IBM App Connect Enterprise, IBM Integration Bus for z/OS. Vendors: IBM.

Quick answers

Is CVE-2026-17444 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-17444 being exploited in the wild.
How severe is CVE-2026-17444?
Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
Is there a fix for CVE-2026-17444?
A patch was published on 2026-09-04: Fix Pack 13.0.8.2 and 12.0.12.29 available; interim fix for z/OS 10.1.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17444 attacked?
It is attacked over the network.
Am I affected by CVE-2026-17444?
Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-17444 is an XML external entity (XXE) injection vulnerability (CWE-611) in IBM App Connect Enterprise adapter nodes that fails to properly restrict XML external entity references. An authenticated network attacker can exploit this by submitting specially crafted XML payloads to trigger XXE expansion, allowing them to read arbitrary files or access sensitive information from the server. The vulnerability requires authentication and accepts input via HTTP with high attack complexity. Patches are available via APAR IT49773 in Fix Pack releases 13.0.8.2 (for v13) and 12.0.12.29 (for v12), with an interim fix for Integration Bus for z/OS 10.1.0.7.

Affected products

  • IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28
  • IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Timeline

  • 2026-09-04: disclosed: Public disclosure via NVD and IBM Security Bulletin
  • 2026-09-04: patched: Fix Pack 13.0.8.2 and 12.0.12.29 available; interim fix for z/OS 10.1.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.