CVE-2026-81832: IBM App Connect Enterprise SAP Adapter XXE injection

CVE-2026-81832 · Severity: high · CVSS 7.7 · Published 2026-09-04

IBM App Connect Enterprise's SAP Adapter is vulnerable to XML external entity (XXE) injection attacks, allowing authenticated remote attackers to read sensitive files and data from systems running affected versions. This vulnerability could expose confidential business data, configuration files, and system credentials to attackers with network access to the integration platform.

Technologies: IBM App Connect Enterprise, IBM Integration Bus for z/OS. Vendors: IBM.

Quick answers

Is CVE-2026-81832 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81832 being exploited in the wild.
How severe is CVE-2026-81832?
High severity, with a CVSS score of 7.7, published 4 September 2026.
Which products and versions are affected?
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28; IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
Is there a fix for CVE-2026-81832?
A patch was published on 2026-09: Fix pack 13.0.8.2 and 12.0.12.29 available; interim fix for 10.1.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81832 attacked?
It is attacked over the network.
Am I affected by CVE-2026-81832?
Check whether you run IBM App Connect Enterprise or IBM Integration Bus for z/OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-81832 is an XXE (XML External Entity) injection vulnerability in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS. The vulnerability exists in the SAP Adapter's XML parsing logic, which fails to properly restrict or validate external entity references when processing XML input (CWE-611). An authenticated remote attacker can exploit this by submitting crafted XML payloads to the adapter, allowing arbitrary file read access and potential information disclosure across system boundaries. The vulnerability requires valid authentication credentials and network access to the affected integration platform. Fixes are available in App Connect Enterprise v13.0.8.2 and v12.0.12.29 via APAR IT49773, and an interim fix is available for Integration Bus for z/OS 10.1.0.7.

Affected products

  • IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28
  • IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Timeline

  • 2026-09-04: disclosed
  • 2026-09: patched: Fix pack 13.0.8.2 and 12.0.12.29 available; interim fix for 10.1.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.