Arbitrary File Write Vulnerability in IBM App Connect Enterprise
CVE-2026-17437

5.5MEDIUM

Key Information:

Vendor

IBM
Status
App Connect Enterprise
Vendor
CVE Published:
8 November 2026

What is CVE-2026-17437?

IBM App Connect Enterprise versions 12.0.1.0 to 12.0.12.29 and 13.0.1.0 to 13.0.8.2 are susceptible to an arbitrary file write vulnerability. This weakness arises from inadequate validation of pathnames during archive extraction processes. A local attacker could exploit this flaw to manipulate file paths, potentially leading to unauthorized access or modification of files on the system. Organizations using these versions should apply the necessary patches as outlined in the vendor advisory to mitigate the risk.

Affected Version(s)

App Connect Enterprise 13.0.1.0 <= 13.0.8.2

App Connect Enterprise 12.0.1.0 <= 12.0.12.29

References

https://www.ibm.com/support/pages/node/7293001
vendor-advisorypatch

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.