CVE-2026-78543

Analyzed Analyzed - Analysis Complete

Denial of Service in IBM App Connect Enterprise

Publication date: 2026-09-04

Last updated on: 2026-09-09

Assigner: IBM Corporation

Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-09

Generated

2026-09-25

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-23

NVD

CVE-2026-78543

EUVD

EUVD-2026-71400

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	app_connect_enterprise	From 12.0.1.0 (inc) to 12.0.12.29 (exc)
ibm	app_connect_enterprise	From 13.0.1.0 (inc) to 13.0.8.2 (exc)
ibm	integration_bus_for_z/os	From 10.1.0.0 (inc) to 10.1.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM App Connect Enterprise and IBM Integration Bus for z/OS. It allows a remote attacker to cause an infinite loop, which can disrupt normal operations by consuming excessive system resources.

Detection Guidance

This vulnerability causes a denial of service due to an infinite loop in IBM App Connect Enterprise and IBM Integration Bus for z/OS. Detection requires monitoring for abnormal CPU usage or unresponsive services. Check for processes consuming excessive CPU with commands like 'top' or 'htop' on Linux, or 'tasklist' on Windows. Inspect network traffic for repeated requests to affected services using tools like Wireshark or tcpdump.

Impact Analysis

The vulnerability can lead to service disruptions, causing applications to become unresponsive or crash. This may result in downtime, degraded performance, and potential loss of data or connectivity for users relying on these IBM products.

Compliance Impact

This vulnerability causes a denial of service due to an infinite loop, which could disrupt system availability. While not directly violating GDPR or HIPAA, such disruptions may impact data processing integrity and availability requirements under these regulations.

Mitigation Strategies

Apply the latest IBM App Connect Enterprise or IBM Integration Bus for z/OS patches immediately. Monitor network traffic for unusual patterns indicating infinite loops. Restrict access to vulnerable systems via firewalls or network segmentation until patched.

Hi! I’m here to help you understand CVE-2026-78543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70