CVE-2026-81832: CWE-611 Improper Restriction of XML External Entity Reference in IBM App Connect Enterprise

CVE-2026-81832 is an XML External Entity (XXE) vulnerability affecting IBM App Connect Enterprise and IBM Integration Bus for z/OS SAP Adapter components. The affected versions include 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and 10.1.0.0 through 10.1.0.7 respectively. This vulnerability arises from improper restriction of XML external entity references (CWE-611), which can be exploited remotely over the network by an attacker with low privileges and no user interaction. The impact is a confidentiality breach with no integrity or availability impact. The vulnerability is publicly disclosed with a CVSS 3.1 base score of 7.7. As of the published date, no official fix or patch has been confirmed by IBM, and no active exploitation has been reported.

An attacker with low privileges can exploit this vulnerability remotely to cause a confidentiality breach by leveraging XML external entity processing flaws. This could lead to unauthorized disclosure of sensitive information. There is no reported impact on integrity or availability. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor IBM's security advisories for updates. No vendor-provided temporary mitigations or workarounds are currently documented.