CVE-2026-78543
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, contain a vulnerability that allows a remote denial of service due to an infinite loop. A remote attacker can exploit this flaw to overload the system and prevent normal operation.
Risk Assessment
The risk is the potential disruption of critical integration systems, leading to service outages and financial losses.
Recommendation
It is recommended to immediately apply patches provided by IBM for affected versions and monitor systems for unusual activity.
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-18196Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
- CVE-2026-18195Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
- CVE-2026-18194Low
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
- CVE-2026-18093High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 has broken access control, allowing a remote attacker to obtain sensitive information.
- CVE-2026-17437Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
- CVE-2026-17416High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17156High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17133High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS