CVE-2026-19649: CWE-532 Insertion of Sensitive Information into Log File in IBM App Connect Enterprise

This vulnerability (CVE-2026-19649) affects IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7. It involves improper logging practices that cause sensitive database credentials to be written into log files. This exposure could allow a local attacker to access these credentials by reading the logs. The vulnerability is categorized under CWE-532, which concerns the insertion of sensitive information into log files. The CVSS 3.1 score of 6.2 reflects a medium severity with a local attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

The vulnerability allows a local attacker to obtain sensitive database credentials by accessing improperly logged information. This could lead to unauthorized access to databases if the credentials are used maliciously. There is no impact on integrity or availability reported. The attack requires local access but no privileges or user interaction, making it moderately risky in environments where local access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the data, users should monitor IBM's advisories for updates. Until a fix is available, restrict local access to systems running affected versions to trusted users only and review log files for sensitive information exposure.