CVE-2026-14519
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.
Risk Assessment
An attacker can access sensitive files such as configurations, passwords, or user data, potentially leading to information disclosure.
Recommendation
Upgrade IBM App Connect Enterprise to a patched version (13.0.7.3 or later for 13.x, 12.0.12.28 or later for 12.x).
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-14522High
IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.
- CVE-2026-12947High
IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-3602Medium
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.26, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, are vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.