CVE-2026-16689: CWE-532 Insertion of Sensitive Information into Log File in IBM App Connect Enterprise

This vulnerability (CVE-2026-16689) involves the insertion of sensitive information, specifically credentials, into log files by IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. A local attacker could leverage this improper logging to access sensitive credential information. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS 3.1 vector indicates local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

A local attacker with access to the affected system could obtain sensitive credential information from log files due to improper logging practices. This could lead to unauthorized access or further compromise of the system. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM advisories for updates. Until a fix is available, restrict local access to systems running affected versions to trusted users only to reduce risk of credential exposure via logs.