« Volver al listado

CVE-2026-19649

Estado: AnalizadaMedia (5.5)—

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — APP Connect EnterpriseIBM — Integration BUS FOR Z/os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-19649",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19649",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-08T17:14:05.266822Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:13.0.8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:app_connect_enterprise:12.0.12.28:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "App Connect Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "13.0.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "13.0.8.1"
            },
            {
              "status": "affected",
              "version": "12.0.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.0.12.28"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:integration_bus_for_zos:10.1.0.7:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Integration Bus for z/OS",
          "versions": [
            {
              "status": "affected",
              "version": "10.1.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.1.0.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-04T16:17:25.100",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7286372",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials."
    }
  ],
  "lastModified": "2026-09-09T14:55:42.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4EB200D-89F9-4102-8255-28ACB2627DD6",
              "versionEndExcluding": "12.0.12.29",
              "versionStartIncluding": "12.0.1.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:app_connect_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "890447E7-5268-4645-899D-C97671DE6EE5",
              "versionEndExcluding": "13.0.8.2",
              "versionStartIncluding": "13.0.1.0"
            },
            {
              "criteria": "cpe:2.3:a:ibm:integration_bus_for_z\\/os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FACEF8F4-50A8-4829-9152-08941B2814D3",
              "versionEndIncluding": "10.1.0.7",
              "versionStartIncluding": "10.1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}