CVE-2026-14522
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.
Risk Assessment
An attacker can remotely execute arbitrary commands on the server, potentially leading to full system compromise and data breach.
Recommendation
Immediately upgrade IBM App Connect Enterprise to a patched version (13.0.7.3 or later for 13.x, 12.0.12.28 or later for 12.x).
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-14519High
IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.
- CVE-2026-12947High
IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.
- CVE-2026-3602Medium
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.26, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, are vulnerable to SQL injection. A remote attacker could socially engineer a user into accidentally creating files they may not be aware of.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.