IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
IBM App Connect Enterprise affected
Version Status Constraints
13.0.1.0 affected ≤ 13.0.8.1
12.0.1.0 affected ≤ 12.0.12.28
IBM Integration Bus for z/OS affected
Version Status Constraints
10.1.0.0 affected ≤ 10.1.0.7

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
App Connect Enterprise Subscribe
Integration Bus For Zos Subscribe
Advisories

No advisories yet.

Fixes

Solution

IBM strongly recommends addressing the vulnerability/vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise and IBM Integration Bus for z/OS Affected Product(s)Version(s)APAR Remediation / Fixes IBM App Connect Enterprise13.0.1.0 - 13.0.8.1IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v13- Fix Pack Release 13.0.8.2 https://www.ibm.com/support/pages/node/7285177 IBM App Connect Enterprise12.0.1.0 - 12.0.12.28IT49773 The APAR (IT49773) is available from  IBM App Connect Enterprise v12- Fix Pack Release 12.0.12.29 https://www.ibm.com/support/pages/node/7284253 IBM Integration Bus for z/OS10.1.0.0 - 10.1.0.7IT49773 Interim Fix for APAR (IT49773) is available to apply to 10.1.0.7 from IBM Fix Central https://www.ibm.com/support/fixcentral/swg/selectFixes

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.ibm.com/support/pages/node/7286372 cve-icon cve-icon
History

Fri, 04 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.
Title IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
First Time appeared Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
Weaknesses CWE-776
CPEs cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.28:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.7:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm app Connect Enterprise
Ibm integration Bus For Zos
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-04T17:32:19.693Z

Reserved: 2026-07-17T23:48:43.870Z

Link: CVE-2026-16180

cve-icon Vulnrichment

Updated: 2026-09-04T17:32:16.205Z

cve-icon NVD

Status : Received

Published: 2026-09-04T17:16:51.977

Modified: 2026-09-04T18:17:48.167

Link: CVE-2026-16180

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T18:30:04Z

Weaknesses