CVE-2026-16180: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in IBM App Connect Enterprise

This vulnerability (CVE-2026-16180) affects IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS Toolkit versions 10.1.0.0 through 10.1.0.7. It is caused by improper validation of XML entities, specifically recursive entity references in DTDs, leading to potential XML entity expansion attacks. An authenticated user can exploit this flaw to cause a denial-of-service condition by triggering excessive resource consumption during XML processing. The CVSS v3.1 base score is 5.7, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting availability only. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An authenticated user can cause a denial-of-service condition by exploiting improper validation of recursive XML entity references, leading to resource exhaustion during XML processing. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected components to trusted users only and monitor for unusual resource consumption patterns related to XML processing.