Quick answers
- Is CVE-2026-78543 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78543 being exploited in the wild.
- How severe is CVE-2026-78543?
- Medium severity, with a CVSS score of 5.3, published 4 September 2026.
- Which products and versions are affected?
- IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
- Is there a fix for CVE-2026-78543?
- A patch was published on 2026-09-04: Fix pack 13.0.8.2 and 12.0.12.29 available via APAR IT49773 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78543 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78543?
- Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an infinite loop (CWE-835) in IBM App Connect Enterprise that allows a remote unauthenticated attacker to trigger a denial of service condition. The infinite loop is reachable over the network with no authentication required, causing the integration server to consume CPU and become unresponsive. An attacker can craft a specific input or message that causes the application to enter an unreachable exit condition loop, effectively denying service to legitimate users. Patches are available via APAR IT49773 in fix pack 13.0.8.2 for version 13.x and 12.0.12.29 for version 12.x.
Affected products
- IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28
- IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7
Timeline
- 2026-09-04: disclosed: CVE-2026-78543 published by IBM
- 2026-09-04: patched: Fix pack 13.0.8.2 and 12.0.12.29 available via APAR IT49773