How do I check whether I am affected by CVE-2026-92559?

Run mqsiversion on each host. Versions 13.0.1.0 through 13.0.8.2 are affected. Also check whether the Connector Discovery listener is reachable from networks it should not be on. IBM does not name the port, so use your own listener or firewall review.

What is the fix for CVE-2026-92559?

Upgrade to IBM App Connect Enterprise 13.0.9.0 or later (APAR IT50100). IBM lists no workaround. Until you upgrade, restrict network access to the host with a firewall.

Who is not affected by CVE-2026-92559?

Not affected if: versions-outside-13.0.1.0-to-13.0.8.2.

Live › vulnerability › CVE-2026-92559

Go to dashboard

critical9.8Vendor

IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2: the Connector Discovery component binds to an unrestricted IP address. A remote, unauthenticated attacker can reach it and obtain sensitive information. IBM's bulletin is titled 'credential exposure'. IBM rates it CVSS 9.8 and lists no workaround. The bulletin does not name the port.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote attacker reads sensitive information from the exposed service.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-92559

Go to dashboard

critical9.8Vendor

IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 20, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.6% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote attacker reads sensitive information from the exposed service.
CVSS said: 9.8. The facts above say medium; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources