IBM has disclosed CVE-2026-92559, a critical-severity (CVSS 9.8) vulnerability in IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 that could let a remote attacker obtain sensitive information because the product binds to an unrestricted IP address.
What Is It
CVE-2026-92559 affects IBM App Connect Enterprise. According to the NVD record, which comes from IBM's PSIRT, the product "could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address." The weakness is classified as CWE-1327.
The record was published to NVD on 2026-10-20. Its NVD status is "Received," so NVD has not finished its own analysis yet.
Why It Matters
IBM PSIRT scored the flaw 9.8 (CRITICAL) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High for confidentiality, integrity, and availability
The exploitability subscore is 3.9 and the impact subscore is 5.9.
The text description mentions only information disclosure, but the scored vector also rates integrity and availability impact as High. Defenders should treat the issue as critical until IBM's advisory clarifies the full impact.
The CISA KEV entry for this CVE is empty, so KEV does not confirm active exploitation at this time. The supplied sources contain no public evidence of exploitation in the wild.
What's Vulnerable
- Vendor: IBM
- Product: App Connect Enterprise
- Affected versions: 13.0.1.0 through 13.0.8.2 (inclusive)
Organizations running any App Connect Enterprise 13.0.x release in that range should assume they are affected. Exposure is higher where integration nodes or servers can be reached from untrusted networks.
Patch Status
The supplied NVD data does not name a fixed version or a specific remediation step, and there is no CISA KEV entry with a required action or due date. IBM's security bulletin, linked below, is the authoritative source for fix packs, upgrade paths, and any interim mitigations.
Recommended next steps:
- Review the IBM support bulletin for the fixed release and apply it.
- Inventory App Connect Enterprise deployments running 13.0.1.0–13.0.8.2.
- Until patched, limit network reachability of affected instances to trusted hosts only.
Sources
- NVD, CVE-2026-92559
- IBM Support; Security Bulletin (node 7291781)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)