Critical Path Traversal Vulnerability in IBM App Connect Enterprise (CVE-2026-15435)

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27, are affected by a path traversal vulnerability tracked as CVE-2026-15435. This vulnerability stems from improper validation of user-supplied input, allowing an unauthenticated, remote attacker to manipulate file paths via directory traversal sequences (e.g., ../). By sending a specially crafted URL request, an attacker can escape the intended application directories and write arbitrary files to the underlying operating system. This flaw, assigned a CVSS v3.1 score of 9.8, poses a significant risk to systems running these versions, as it may lead to full system compromise if an attacker is able to overwrite critical configuration or executable files.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing IBM App Connect Enterprise instances.
2. Attacker crafts an HTTP request targeting a vulnerable endpoint within the application.
3. Attacker injects directory traversal sequences (e.g., /../) into the URL request parameters or path.
4. The application fails to sanitize the input, allowing the path to resolve outside the restricted base directory.
5. The server process, executing with its current privileges, attempts to write the payload contained in the request to the target destination.
6. The arbitrary file is successfully written to the system, enabling potential code execution or system modification.

Impact

Successful exploitation of this vulnerability allows for unauthorized file writes on the host system. Depending on the target location of the written file, this can result in the modification of application logic, the injection of malicious scripts, or the alteration of system-level configuration files, ultimately leading to remote code execution and complete loss of system integrity.

Recommendation

Prioritize the immediate patching of all affected IBM App Connect Enterprise instances to the versions identified by IBM as containing the fix.

• Upgrade to IBM App Connect Enterprise version 13.0.7.3 or higher, or 12.0.12.28 or higher, as referenced in the IBM security advisory (https://www.ibm.com/support/pages/node/7281896).
• Deploy the Sigma rules below to monitor web server logs for path traversal attempts targeting the App Connect Enterprise interface.
• Implement strict ingress filtering at the network perimeter to restrict access to the administration interfaces of IBM App Connect Enterprise to authorized subnets only.

Impact

1. No specific victim data is reported; the vulnerability affects organizations utilizing IBM App Connect Enterprise in the specified versions.