SYS::ONLINE
Wasteland.
Briefs1634
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-15435 2026-07-30

CVE-2026-15435: Critical Path Traversal in IBM App Connect Enterprise

"IBM disclosed a CVSS 9.8 directory traversal flaw in App Connect Enterprise that lets an unauthenticated remote attacker write arbitrary files to the host."

IBM disclosed a CVSS 9.8 directory traversal flaw in App Connect Enterprise that lets an unauthenticated remote attacker write arbitrary files to the host.

What Is It

CVE-2026-15435 is a path traversal vulnerability (CWE-22) in IBM App Connect Enterprise. According to IBM's advisory, an attacker can send a specially crafted URL request containing "dot dot" sequences (/../) to traverse directories on the system and write arbitrary files.

The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That breakdown matters: the attack is reachable over the network, requires low complexity, needs no privileges, and needs no user interaction; while impacting confidentiality, integrity, and availability at HIGH.

Why It Matters

Arbitrary file write on a network-facing integration platform is a serious primitive. App Connect Enterprise typically sits between systems, brokering data across application and service boundaries, which makes any host-level compromise consequential beyond the single server.

No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time. The record's NVD status is "Undergoing Analysis," published 2026-07-30.

What's Vulnerable

Per the NVD record, the affected products are:

Both ranges are listed as affected inclusive of the upper bound. The reporting source is IBM PSIRT ([email protected]).

Patch Status

The supplied data does not specify fixed version numbers or a required remediation deadline. IBM has published a support advisory at node 7281896, which is the authoritative source for remediation guidance; administrators running either affected branch should consult it directly and prioritize accordingly given the 9.8 severity and the absence of any authentication requirement.

No CISA-mandated due date applies, as no KEV entry accompanies this record.

Sources