IBM disclosed a CVSS 9.8 directory traversal flaw in App Connect Enterprise that lets an unauthenticated remote attacker write arbitrary files to the host.
What Is It
CVE-2026-15435 is a path traversal vulnerability (CWE-22) in IBM App Connect Enterprise. According to IBM's advisory, an attacker can send a specially crafted URL request containing "dot dot" sequences (/../) to traverse directories on the system and write arbitrary files.
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That breakdown matters: the attack is reachable over the network, requires low complexity, needs no privileges, and needs no user interaction; while impacting confidentiality, integrity, and availability at HIGH.
Why It Matters
Arbitrary file write on a network-facing integration platform is a serious primitive. App Connect Enterprise typically sits between systems, brokering data across application and service boundaries, which makes any host-level compromise consequential beyond the single server.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time. The record's NVD status is "Undergoing Analysis," published 2026-07-30.
What's Vulnerable
Per the NVD record, the affected products are:
- IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2
- IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27
Both ranges are listed as affected inclusive of the upper bound. The reporting source is IBM PSIRT ([email protected]).
Patch Status
The supplied data does not specify fixed version numbers or a required remediation deadline. IBM has published a support advisory at node 7281896, which is the authoritative source for remediation guidance; administrators running either affected branch should consult it directly and prioritize accordingly given the 9.8 severity and the absence of any authentication requirement.
No CISA-mandated due date applies, as no KEV entry accompanies this record.
Sources
- NVD, CVE-2026-15435: https://nvd.nist.gov/vuln/detail/CVE-2026-15435
- IBM Support Advisory (node 7281896): https://www.ibm.com/support/pages/node/7281896