---
id: "CVE-2026-92559"
kind: "vulnerability"
aliases: ["CVE-2026-92559"]
title: "IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers"
severity: "critical"
cvss: 9.8
epss: 0.00633
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM App Connect Enterprise", "fixed": ["13.0.9.0"], "affected": ">= 13.0.1.0, <= 13.0.8.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["connector-discovery", "ibm-app-connect-enterprise", "runtime", "self-hosted", "vendor"]
not_affected_if: ["versions-outside-13.0.1.0-to-13.0.8.2"]
published_at: "2026-10-20T22:21:07+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92559", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:53:00+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92559", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackers

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2: the Connector Discovery component binds to an unrestricted IP address. A remote, unauthenticated attacker can reach it and obtain sensitive information. IBM's bulletin is titled 'credential exposure'. IBM rates it CVSS 9.8 and lists no workaround. The bulletin does not name the port.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM App Connect Enterprise affected >= 13.0.1.0, <= 13.0.8.2 fixed 13.0.9.0

## How to check

Run mqsiversion on each host. Versions 13.0.1.0 through 13.0.8.2 are affected. Also check whether the Connector Discovery listener is reachable from networks it should not be on. IBM does not name the port, so use your own listener or firewall review.

## Fix

Upgrade to IBM App Connect Enterprise 13.0.9.0 or later (APAR IT50100). IBM lists no workaround. Until you upgrade, restrict network access to the host with a firewall.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92559
- 2026-10-23T22:53:00+00:00 analyst — IBM bulletin (Oct 9 2026): flaw is in ACE Connector Discovery component, credential exposure, CVSS 9.8 (IBM), APAR IT50100, fixed in 13.0.9.0, no workaround. Bulletin names no port. fixthecve.com says 13.0.8.3, contradicting IBM; I used IBM. No exploitation or PoC found; no social discussion searched.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92559

## Documents

- [advisory] IBM Security Bulletin: App Connect Enterprise credential exposure (CVE-2026-92559) https://www.ibm.com/support/pages/security-bulletin-ibm-app-connect-enterprise-vulnerable-credential-exposure-cve-2026-92559
- [fix] Fix list for IBM App Connect Enterprise 13.0 (13.0.9.0 includes IT50100) https://www.ibm.com/support/pages/fix-list-ibm-app-connect-enterprise-version-130

## From the sources

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_