CVE-2026-12947
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.
Risk Assessment
A local user with access to log files can obtain sensitive data such as passwords or API keys, potentially leading to privilege escalation.
Recommendation
Configure appropriate permissions on log files and consider disabling logging of sensitive data. Upgrade to a patched version is recommended.
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-14522High
IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.
- CVE-2026-14519High
IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.
- CVE-2026-3602Medium
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.26, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, are vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.