{"id":"CVE-2026-92559","kind":"vulnerability","aliases":["CVE-2026-92559"],"related":[],"title":"IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers","description":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.","summary":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2: the Connector Discovery component binds to an unrestricted IP address. A remote, unauthenticated attacker can reach it and obtain sensitive information. IBM's bulletin is titled 'credential exposure'. IBM rates it CVSS 9.8 and lists no workaround. The bulletin does not name the port.","severity":"critical","cvss":9.8,"epss":0.00633,"exploited":false,"exploited_at":null,"products":[{"name":"IBM App Connect Enterprise","fixed":["13.0.9.0"],"affected":">= 13.0.1.0, <= 13.0.8.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["connector-discovery","ibm-app-connect-enterprise","runtime","self-hosted","vendor"],"not_affected_if":["versions-outside-13.0.1.0-to-13.0.8.2"],"how_to_check":"Run mqsiversion on each host. Versions 13.0.1.0 through 13.0.8.2 are affected. Also check whether the Connector Discovery listener is reachable from networks it should not be on. IBM does not name the port, so use your own listener or firewall review.","fix":"Upgrade to IBM App Connect Enterprise 13.0.9.0 or later (APAR IT50100). IBM lists no workaround. Until you upgrade, restrict network access to the host with a firewall.","status":"open","published_at":"2026-10-20T22:21:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:33+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:33:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers","impact":"medium","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 listen on an unrestricted IP address, so a remote attacker can reach them. The sources say the attacker can obtain sensitive information; the exact data exposed is not stated.","category":"vendor","who_cares":["ibm-app-connect-enterprise","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reads sensitive information from the exposed service","analyst_note":"Find the IBM security bulletin for this CVE to confirm the affected port, the data exposed, and the fixed version; the NVD entry gives none of these.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-13.0.1.0-to-13.0.8.2"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000484,"input_tokens":2910,"output_tokens":386,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for this CVE to confirm the affected port, the data exposed, and the fixed version; the NVD entry gives none of these.","search":"'-2026':14A,17A '-92559':15A,18A '13.0.1.0':40B,91C '13.0.8.2':42B,93C '9.8':75B 'address':52B,110C 'allow':95C 'app':2A,20A,28B,37B,88C 'attack':12A,56B,98C 'bind':6A,47B,105C 'bulletin':66B,81B 'compon':46B 'connect':3A,21A,29B,38B,89C 'connector':24B,44B 'connector-discoveri':23B 'could':94C 'credenti':69B 'cve':13A,16A 'cvss':74B 'data':9A 'discoveri':25B,45B 'due':103C 'enterpris':4A,30B,39B,90C 'enterprise':22A 'exposur':70B 'host':34B 'ibm':1A,19A,27B,36B,64B,71B,87C 'ibm-app-connect-enterpris':26B 'inform':63B,102C 'ip':51B,109C 'leak':7A 'list':77B 'name':84B 'obtain':61B,100C 'port':86B 'rate':72B 'reach':58B 'remot':11A,54B,97C 'runtim':31B 'self':33B 'self-host':32B 'sensit':8A,62B,101C 'titl':68B 'unauthent':55B 'unrestrict':5A,50B,108C 'vendor':35B 'workaround':79B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92559","severity":null,"published_at":"2026-10-20T22:21:07+00:00","modified_at":"2026-10-23T12:18:18+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92559:319","url":null,"severity":null,"published_at":"2026-10-23T22:53:00+00:00","modified_at":"2026-10-23T22:53:00+00:00","first_seen_at":"2026-10-23T22:53:00+00:00","fetched_at":"2026-10-23T22:53:00+00:00","note":"IBM bulletin (Oct 9 2026): flaw is in ACE Connector Discovery component, credential exposure, CVSS 9.8 (IBM), APAR IT50100, fixed in 13.0.9.0, no workaround. Bulletin names no port. fixthecve.com says 13.0.8.3, contradicting IBM; I used IBM. No exploitation or PoC found; no social discussion searched."},{"source":"epss","external_id":"CVE-2026-92559","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92559","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1638,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-vulnerable-credential-exposure-cve-2026-92559","title":"IBM Security Bulletin: App Connect Enterprise credential exposure (CVE-2026-92559)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1640,"url":"https://www.ibm.com/support/pages/fix-list-ibm-app-connect-enterprise-version-130","title":"Fix list for IBM App Connect Enterprise 13.0 (13.0.9.0 includes IT50100)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}