CVE-2026-17443: CWE-611 Improper Restriction of XML External Entity Reference in IBM App Connect Enterprise

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 contain an XML External Entity (XXE) injection vulnerability (CWE-611). This flaw allows a remote attacker with low privileges and network access to cause the application to process malicious XML input, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS 3.1 base score is 5.3, reflecting medium severity with network attack vector, high attack complexity, and low privileges required. As of the published date, no official patch or remediation level has been announced by IBM, and no exploits in the wild are known.

The vulnerability allows a remote authenticated attacker to obtain sensitive information by exploiting an XXE injection flaw. This compromises confidentiality but does not affect integrity or availability. The attack requires network access and low privileges but has high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected services to trusted users only and monitor for suspicious activity related to XML processing. Follow IBM's security advisories for updates on patches or mitigations.