CVE-2026-19649
Received Received - Intake

IBM App Connect Enterprise Credential Exposure via Improper Logging

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: IBM Corporation

Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-19649
EUVD
EUVD-2026-71258

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ibm app_connect_enterprise From 13.0.1.0 (inc) to 13.0.8.1 (inc)
ibm app_connect_enterprise From 12.0.1.0 (inc) to 12.0.12.28 (inc)
ibm integration_bus_for_zos From 10.1.0.0 (inc) to 10.1.0.7 (inc)
ibm app_connect_enterprise to 13.0.8.2 (inc)
ibm app_connect_enterprise to 12.0.12.29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7, have a flaw where database credentials are logged improperly. This allows a local attacker to access sensitive information due to the insecure logging practice.

Impact Analysis

A local attacker could exploit this to obtain database credentials, potentially leading to unauthorized access to sensitive data stored in the affected systems. This could result in data breaches or further exploitation of the compromised environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected software may face legal and regulatory penalties for failing to protect personal or health information adequately.

Mitigation Strategies

Apply the fix provided in APAR IT49773 available in IBM App Connect Enterprise v13 Fix Pack 13.0.8.2 and v12 Fix Pack 12.0.12.29. Review and secure database credential logging practices to prevent exposure of sensitive information.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart