CVE-2026-14522

CVSS 8.8v3.1pub. 2026-07-30upd. 2026-08-05

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM App Connect Enterprise
APP
Ibm
12.0.1.0 – 12.0.12.28 (excl.)13.0.1.0 – 13.0.8.0 (excl.)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

Command Injection

CWE

CWE-78

References

www.ibm.com/support/pages/node/7281897…

Related vulnerabilities

CVE-2026-15435CRITICAL9.8PL ✓same product

Path Traversal w IBM App Connect Enterprise umożliwiający zapis dowolnych plików

CVE-2024-22317CRITICAL9.1PL ✓same product

IBM App Connect Enterprise — brak limitu prób uwierzytelnienia (DoS/ujawnienie danych)

CVE-2026-12947HIGH7.5PL ✓same product

IBM App Connect Enterprise – ujawnienie wrażliwych danych w plikach logów

CVE-2026-14519HIGH7.5PL ✓same product

IBM App Connect Enterprise — path traversal umożliwia odczyt dowolnych plików

CVE-2026-3602MEDIUM4.7same product

IBM App Connect Enterprise w wersjach 13.0.1.0 do 13.0.7.2, 12.0.1.0 do 12.0.12.26 oraz IBM Integration Bus fo...