CVE-2026-17444
mediumpriority · track · 26EPSS 0.004 · 34 %ileUSgrimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.40% (34th) EPSS
CVSS 6.5 · medium
Who says so?
1 sources
nvd
EPSS · scored 2026-10-28
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
01
cvss
Technical severity, 0–10. One row per scoring source.
6.5
010
base score 0–10 · higher = more severe · hover a vector to decode
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6
v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · psirt@us.ibm.com USexploitability 1.6 · impact 3.6
02
weaknesses
The CWE weakness classes this flaw belongs to.
03
affected products (3)
Products and version ranges known to be affected.
- ibm app connect enterprise12.0.1.0 → 12.0.12.29nvdUScpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*
- ibm app connect enterprise13.0.1.0 → 13.0.8.2nvdUScpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*
- ibm integration bus for z/os10.1.0.0 → 10.1.0.7nvdUScpe:2.3:a:ibm:integration_bus_for_z\/os:*:*:*:*:*:*:*:*
04
sources
Which sources assert this record, and when.
05
references (1) nvd
External citations — patches, advisories, analysis.
- https://www.ibm.com/support/pages/node/7286372PatchVendor Advisory
scry
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan