CVSS 5.5 (medium) · published 2026-11-08
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
Affected products (NVD): ibm app_connect_enterprise
Fixed in (NVD): 12.0.12.30, 13.0.9.0
Weakness: CWE-22
Source: NVD CVE-2026-17437
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.