CVE-2026-17133
Received Received - Intake

IBM App Connect Enterprise OS Command Injection Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-17133
EUVD
EUVD-2026-77786

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm app_connect_enterprise From 13.0.1.0 (inc) to 13.0.8.0 (inc)
ibm app_connect_enterprise From 12.0.1.0 (inc) to 12.0.12.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM App Connect Enterprise allows a local attacker to execute arbitrary code on the system. It occurs due to improper neutralization of special elements used in an OS command, meaning the software does not properly handle input that could alter system commands.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system with elevated privileges. This could lead to unauthorized access, data theft, or system compromise. The impact depends on the attacker's goals and the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations may face penalties or legal consequences if sensitive data is exposed due to this flaw.

Mitigation Strategies

Update IBM App Connect Enterprise to a version beyond 13.0.8.0 or 12.0.12.27 to address the improper neutralization of OS commands. Apply patches as soon as possible to prevent local attackers from executing arbitrary code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart