IBM App Connect Enterprise: Information disclosure via unrestricted IP binding
Summary
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 bind to an unrestricted IP address. A remote attacker can obtain sensitive information, such as credentials, without authentication, according to IBM's CVSS base score of 9.8. The bulletin does not specify which listener or port is affected or which default configuration is involved.
Affected
- IBM App Connect Enterprise 13.0.1.0 to 13.0.8.2 (Windows, Linux, AIX)
Fixed in
- Apply APAR IT50100 via IBM App Connect Enterprise v13 Fix Pack 13.0.9.0
- Exact fix-pack level to be confirmed on the IBM bulletin before rollout
Workaround
- Unknown. IBM lists no workaround; the bulletin only recommends applying the fix.
- Until patched, restrict the network interfaces and ports ACE listens on and block untrusted networks at the firewall (own suggestion, not vendor-stated; verify the setting in IBM documentation first).
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV.
- No public proof of concept reported.
- No vendor-reported exploitation found.
Our recommendation
- Identify all ACE 13.0.1.0 to 13.0.8.2 installations.
- Check whether these hosts are reachable from the internet or untrusted network segments and restrict access.
- Schedule the upgrade to Fix Pack 13.0.9.0 (APAR IT50100) with priority.
- If exposure is suspected, rotate credentials stored on the affected hosts.
- Monitor logs for unusual access to ACE listeners.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-92559 www.ibm.com
- CVE record via vulners (CNA data) vulners.com
- OpenCVE CVE-2026-92559 (CVSS and CISA SSVC) app.opencve.io
- TheHackerWire CVE-2026-92559 (no public PoC reported) www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:07.
Original description (NVD)
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.