CVE-2026-14522 is an OS command injection vulnerability (CWE-78) in IBM App Connect Enterprise. Versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are affected. The issue arises from improper neutralization of CRLF characters, which can be exploited by a remote attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the affected IBM App Connect Enterprise installations. This can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the affected IBM App Connect Enterprise instances and monitor for unusual activity related to command execution. Avoid exposing vulnerable versions to untrusted networks.