CVE-2026-15435
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
Risk Assessment
An attacker can write arbitrary files on the system, potentially leading to malicious code execution, configuration modification, or data leakage.
Recommendation
Upgrade to version 13.0.7.3 or 12.0.12.28 (or later), which includes a fix for the vulnerability.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.