← Back

CVE-2026-16180

nvd nist
Published: Sep 4, 2026Modified: Sep 9, 2026

JSON object

Loading...
5.7
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Exploitability: 2.1 / Impact: 3.6
Source: psirt@us.ibm.com (Secondary)

Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.

Affected (3)

Ibm
2 products
App Connect Enterprise
Integration Bus For Z/os
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
App Connect Enterprise
12.0.1.0 ≤ version < 12.0.12.29
App Connect Enterprise
13.0.1.0 ≤ version < 13.0.8.2
Integration Bus For Z/os
10.1.0.0 ≤ version ≤ 10.1.0.7

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (1)

Source: psirt@us.ibm.com
PatchVendor Advisory

Timeline

No history available yet.