CVE-2026-17156
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.14%
- CWE
- CWE-502
- Published
- 2026-09-14
- Last modified
- 2026-09-15
Affected products
- IBM App Connect Enterprise
- IBM App Connect Enterprise
Weakness type
Related vulnerabilities
- CVE-2026-87719 — Deserialization of Untrusted Data in GitLab
- CVE-2026-72649 — Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-82222 — WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-70416 — Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthentica
- CVE-2026-17061 — Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
- CVE-2026-4703 — WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
- CVE-2026-20307 — Cisco Identity Services Engine Remote Code Execution Vulnerability
- CVE-2026-12650 — A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated