CVE-2026-17416 affects IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27. The vulnerability arises from insecure deserialization, which can be exploited by a local attacker to execute arbitrary code. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is necessary. The impact includes high confidentiality, integrity, and availability consequences. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation allows a local attacker to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the application and underlying system. The attack requires local access and user interaction, limiting remote exploitation possibilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict local access to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid executing untrusted serialized data within the application environment.