Skip to content
Numerous vulnerabilities put IBM App Connect Enterprise at risk

Numerous vulnerabilities put IBM App Connect Enterprise at risk

Heise.De • November 10, 2026

Attackers can target IBM’s App Connect Enterprise integration software, among other products, and, in the worst-case compromise systems. So far, the software maker has not indicated that attackers are already exploiting the vulnerabilities.

According to IBM’s first security advisory and a second security advisory , the vulnerabilities affecting App Connect Enterprise are in various Node.js modules and libraries. Attackers can execute malicious code through two vulnerabilities in the Handlebars template engine rated “ critical ” (CVE-2026-106446, CVE-2026-106445). In both cases, attackers must supply victims with specially crafted objects or templates; when these are processed, injected JavaScript code runs in the server process.

Attackers can also cause crashes through vulnerabilities in Apache Thrift (including CVE-2026-83745, rated “ high ”) or Axios (including CVE-2026-101901, rated “ high ”). A vulnerability in the MCP TypeScript SDK (CVE-2026-111767, rated “ high ”) lets attackers view data that should be protected.

The developers say they fixed the security issues in IBM App Connect Enterprise v12 – Fix Pack Release 12.0.12.31 and IBM App Connect Enterprise v13 – Fix Pack Release 13.0.9.1 .

The Log Source Management App for IBM QRadar SIEM is vulnerable to five security flaws, according to a post . Four are rated “ high ” severity (CVE-2026-112366, CVE-2026-93748, CVE-2026-93749, CVE-2026-93687). Attackers can, for example, disrupt services or use a vulnerability in http-cache-semantics to access other users' session cookies. Version 7.0.19 is said to address the issues.

In the 1.12.0.4 Fix Pack release for TS4500 Tape Library, the developers fixed a software vulnerability ( CVE-2026-19133 , rated “ high ”). Attackers with low privileges who are logged in can use it to change other users' passwords and take over their accounts.

Most recently, in mid-October, IBM fixed DoS vulnerabilities in IBM SPSS Modeler.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.