IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7… (CVE-2026-16180)

This vulnerability (CVE-2026-16180) affects IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit versions specified. The flaw arises from improper validation of XML entities, which can be exploited by an authenticated user to trigger a denial-of-service condition. The CVSS 3.1 base score is 5.7, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacting availability only. No confidentiality or integrity impact is noted. There is no information about available patches or vendor advisories in the provided data.

An authenticated user can exploit this vulnerability to cause a denial-of-service condition, potentially disrupting service availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit authenticated user access to trusted personnel and monitor for unusual activity related to XML processing in the affected products.