CVE-2026-15435: IBM App Connect Enterprise arbitrary file write
TL;DR - Critical IBM App Connect Enterprise flaw allows remote arbitrary file write through crafted
/../URL sequences. - Affects ACE 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27. - Patch immediately; no confirmed in-the-wild exploitation is publicly documented yet.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-15435 |
| CVSS score | 9.8 (Critical) |
| Attack vector | Network |
| Privileges required | None publicly stated; defenders should assume unauthenticated remote reachability unless IBM documents otherwise |
| Patch available | Yes, IBM has published a security bulletin; exact remediation build should be confirmed in the vendor bulletin |
CVE-2026-15435 is a critical vulnerability in IBM App Connect Enterprise (ACE). According to the NVD description, a remote attacker can use specially crafted URL requests containing ../ traversal sequences to write arbitrary files on the system. That makes this more than a simple path traversal bug: the impact is arbitrary file write, which can materially increase the chance of service compromise or follow-on code execution depending on where files can be written.
For defenders, the operational takeaway is straightforward. This is a remotely reachable flaw with severe impact, broad affected version ranges across two major release trains, and a published vendor bulletin on the same day as disclosure. Even without confirmed exploitation in the wild, a 9.8-rated arbitrary file write issue in integration middleware should be treated as high-priority patching and exposure-reduction work.
What Is This Vulnerability?
At its core, CVE-2026-15435 is an improper path handling issue. IBM App Connect Enterprise reportedly fails to safely constrain file path resolution when processing a crafted URL request. An attacker can insert dot dot traversal sequences such as /../ into the request path, allowing the application to escape its intended directory boundaries and target files elsewhere on the underlying system.
The important distinction here is impact. Many directory traversal flaws are limited to file read or path disclosure. In this case, the published description states the attacker can write arbitrary files on the system. Arbitrary file write can be enough to overwrite configuration, alter application content, plant malicious files in trusted paths, or disrupt service operation. In some deployments, especially where the service account has broad filesystem permissions or where written files are later executed or loaded, arbitrary file write can be a stepping stone to full system compromise.
Technical Notes
A representative malicious request pattern would include traversal sequences in a URL path segment:
POST /some/path/../../../../tmp/target.file HTTP/1.1
Host: ace.example.com
Content-Type: application/octet-stream
Content-Length: 1234
[attacker-controlled content]
At a minimum, defenders should assume the vulnerable code path involves insufficient normalization or validation of filesystem paths derived from HTTP request components. If reverse proxies, WAFs, or ingress gateways normalize paths differently than the application does, edge-layer filtering may not be sufficient by itself.
Who Is Affected?
Based on the NVD record and IBM advisory metadata, the following IBM App Connect Enterprise versions are affected:
- IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2
- IBM App Connect Enterprise 12.0.1.0 through 12.0.12.27
Those quoted ranges are the strongest source-backed version data available from the provided materials. If you are running any build within those boundaries, you should consider the system vulnerable until patched or otherwise mitigated. If you operate mixed-version environments, do not assume that upgrading one runtime or one node is sufficient; inventory all ACE instances, including clustered nodes, DR environments, and less-visible non-production systems that may still be internet-reachable or accessible from partner networks.
The exact fixed version number is the point where defenders should be careful not to guess. The available research note indicates that the first non-affected versions are likely the next maintenance builds after the affected ranges, such as 13.0.8.0 or later and 12.0.12.28 or later, but the full IBM remediation table was not captured in the source text provided here. Practically, that means teams should use the IBM bulletin as the authoritative source before scheduling upgrades, and should not rely on inferred build numbers alone for change control documentation.
Technical Notes
To identify installed ACE versions on Linux systems, admins commonly validate package or runtime versioning locally before remediation:
mqsilist -v
If ACE is installed through platform package management or containerized deployment, also verify the build tag in your deployment source of truth:
rpm -qa | grep -i "app connect\|ace"
dpkg -l | grep -i "app connect\|ace"
kubectl get deploy,statefulset -A -o yaml | grep -i "app connect\|ace\|13.0\|12.0"
CVSS Score Breakdown
The published base score is 9.8, which places CVE-2026-15435 in the Critical severity band. Although the specific NVD vector string was not included in the provided research note, a 9.8 score in practice usually aligns with a remotely exploitable weakness that requires no privileges and has high impact across confidentiality, integrity, and availability, or at least enough impact to approach the maximum base score.
That score is justified by the nature of the bug. Network reachability plus arbitrary file write is a dangerous combination. Even if the vulnerability does not directly grant command execution by itself, arbitrary file write can still let an attacker tamper with deployed content, overwrite configuration, poison logs, create persistence footholds, or crash services by damaging required files. If the service account has broad permissions, the downstream blast radius can expand quickly.
In practical risk terms, the CVSS number matters less than the deployment context. If your ACE administration endpoints or HTTP interfaces are internet-facing, reachable from partners, or exposed across large internal flat networks, treat this as urgent. If the instance sits behind strict segmentation and authenticated gateways, the immediate exploitability may be lower, but the severity remains high because the primitive is strong and the target is integration middleware that often has access to sensitive data flows.
Technical Notes
Because the exact vector string was not available in the supplied source material, defenders should document the score as published and avoid filling in unsupported details in reports:
CVSS Base Score: 9.8 (Critical)
Vector string: not confirmed from the available source set in this analysis
Defender assumption: remotely reachable, severe integrity impact due to arbitrary file write
Exploitation Status
As of 2026-07-30, there is no confirmed evidence in the provided source set that CVE-2026-15435 is being actively exploited in the wild. The research note states that the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no KEV-based confirmation of active exploitation at this time.
There is also no verified public proof-of-concept exploit referenced in the provided primary sources. That does not mean exploit development is difficult, only that no specific PoC URL or public exploit reference was identified from the NVD references and vendor advisory material available here. Because the vulnerability description is technically clear, defenders should assume that private exploit development is feasible and that public exploit code could emerge quickly after disclosure.
Operationally, the safest stance is: not confirmed exploited, no verified public PoC identified, but treat as high risk anyway. Critical remote arbitrary file write bugs in middleware products often attract attention because they can affect integration nodes with privileged connectivity to back-end systems. Waiting for KEV inclusion or exploit telemetry before patching would be a poor risk decision.
Technical Notes
Priority guidance for SOC and vulnerability management teams:
Known exploited in the wild: No public confirmation from CISA KEV as of 2026-07-30
Public PoC: None verified from the provided source set
Recommended prioritization: Emergency/expedited patch cycle due to CVSS 9.8 and remote arbitrary file write impact
How to Detect It
Detection starts with exposure mapping. Identify all IBM App Connect Enterprise HTTP-exposed services, management interfaces, API endpoints, reverse-proxied applications, and any externally reachable listeners. Then look for URL paths containing traversal attempts such as /../, URL-encoded variants like %2e%2e%2f, and repeated normalization tricks. Because the attack is described as request-based, web access logs, reverse proxy logs, ingress controller telemetry, and WAF events are the most useful first sources.
The second detection focus is file integrity and unexpected write activity on ACE hosts. Even if the initial HTTP request is not logged completely, arbitrary file write tends to leave traces: new files under temporary directories, overwritten configuration, anomalous timestamps in application paths, or service instability after unexpected file modification. Correlate suspicious URL requests with filesystem changes and ACE process activity. If you find traversal attempts against a vulnerable version, assume compromise is possible until proven otherwise.
Technical Notes
Example web or proxy log patterns to hunt for:
(\./|%2e%2e%2f|%2e%2e/|..%2f|%252e%252e%252f)
Example grep hunt across access logs:
grep -RniE '(\./|%2e%2e%2f|%2e%2e/|..%2f|%252e%252e%252f)' /var/log/nginx /var/log/httpd /var/log/apache2 /var/log
Example Splunk query:
index=web OR index=proxy OR index=waf
("..\/" OR "%2e%2e%2f" OR "%2e%2e/" OR "..%2f" OR "%252e%252e%252f")
| stats count by src_ip, dest, uri_path, http_method, user_agent
Example Sigma-style detection logic concept:
title: Path Traversal Attempts Against IBM ACE
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- "../"
- "%2e%2e%2f"
cs-uri-stem|contains:
- "../"
- "%2e%2e%2f"
condition: selection
level: high
For host-side follow-up, examine recent file modifications in ACE-related directories and temp paths:
find / -xdev -type f -mtime -2 2>/dev/null | grep -Ei 'ace|appconnect|mqsi|tmp|var/tmp'
Mitigation and Patching
The primary mitigation is to upgrade IBM App Connect Enterprise to a vendor-fixed release. The affected ranges are explicitly documented as 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27. The research note indicates that the first non-affected releases are likely 13.0.8.0 or later and 12.0.12.28 or later, but because the exact remediation table was not fully captured from IBM’s bulletin in the provided material, you should verify the precise fixed build directly in the IBM advisory before implementation.
If you cannot patch immediately, reduce exposure. Restrict network access to ACE HTTP endpoints with firewall rules, reverse-proxy ACLs, or VPN-only access. Add temporary WAF or ingress filtering for traversal sequences, including encoded variants, understanding that this is only a compensating control. Review filesystem permissions for the ACE service account and remove unnecessary write access where feasible. These steps can reduce risk, but they do not eliminate the vulnerable code path.
Technical Notes
Before upgrading, confirm the installed version:
mqsilist -v
Because install methods vary by platform and packaging, the exact upgrade command depends on how ACE is deployed. Example workflow for Linux package-based upgrades after downloading the vendor-fixed package from IBM:
# RHEL / CentOS style example
sudo systemctl stop ace
sudo rpm -Uvh IBM-App-Connect-Enterprise-<fixed-version>.x86_64.rpm
sudo systemctl start ace
mqsilist -v
# Debian / Ubuntu style example
sudo systemctl stop ace
sudo dpkg -i ibm-app-connect-enterprise-<fixed-version>_amd64.deb
sudo systemctl start ace
mqsilist -v
For containerized deployments, update the image tag to the vendor-fixed release verified in IBM’s bulletin and redeploy:
kubectl set image deployment/ace ace=registry.example.com/ace:<fixed-version> -n <namespace>
kubectl rollout status deployment/ace -n <namespace>
Temporary reverse-proxy blocking example for NGINX:
location / {
if ($request_uri ~* "(\./|%2e%2e%2f|%2e%2e/|..%2f|%252e%252e%252f)") {
return 403;
}
proxy_pass http://ace_backend;
}
Use this workaround only as an interim control. Path normalization evasions are common, and application patching remains the required fix.
References
The primary reference for CVE-2026-15435 is the IBM security bulletin. It is the authoritative source for remediation guidance, supported version details, and any later vendor clarifications. The NVD entry is useful for standardized vulnerability metadata and broad inventory matching, while the CISA KEV catalog helps defenders determine whether US government-tracked active exploitation has been confirmed.
When documenting this issue internally, cite the vendor bulletin first, then the NVD record, and finally CISA KEV status for exploitation context. Because some remediation details were not fully captured in the provided source text, defenders should pull the current IBM bulletin directly during the patch window to confirm exact fixed builds and any product-specific upgrade notes.
-
IBM Security Bulletin: IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability (CVE-2026-15435)
https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-vulnerable-arbitrary-file-write-vulnerability-cve-2026-15435-1 -
IBM advisory node URL referenced by NVD
https://www.ibm.com/support/pages/node/7281896 -
NVD CVE record for CVE-2026-15435
https://nvd.nist.gov/vuln/detail/CVE-2026-15435 -
CISA Known Exploited Vulnerabilities Catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
For further reading on related topics, you may explore our articles on what is path traversal and what is logic bomb.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.