CVE-2026-17444: CWE-611 Improper Restriction of XML External Entity Reference in IBM App Connect Enterprise

This vulnerability (CVE-2026-17444) involves improper restriction of XML external entity references (CWE-611) in IBM App Connect Enterprise and IBM Integration Bus for z/OS. Remote authenticated attackers could exploit this flaw to perform XML External Entity (XXE) injection attacks, potentially allowing them to access sensitive information. The vulnerability affects multiple versions of IBM App Connect Enterprise (13.0.1.0 to 13.0.8.1 and 12.0.1.0 to 12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0 to 10.1.0.7). The CVSS v3.1 base score is 5.3, indicating medium severity, with attack vector network, high attack complexity, low privileges required, no user interaction, and impact limited to confidentiality.

An attacker with remote authenticated access could exploit this vulnerability to obtain sensitive information through XXE injection. The impact is limited to confidentiality compromise; integrity and availability are not affected. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, limit access to trusted users and monitor for unusual activity related to XML processing. Follow IBM's official advisories for updates.