CVE-2026-14522 is a command execution flaw in IBM App Connect Enterprise, scored 8.8 (high). IBM says a remote attacker could run arbitrary commands because CRLF characters are not neutralized properly. IBM's fix is APAR IT49745, delivered in fix pack 13.0.8.0 for the 13 line and 12.0.12.28 for the 12 line.
What's affected
- Product: IBM App Connect Enterprise.
- Affected: 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27.
- Fixed: APAR IT49745, available in fix pack 13.0.8.0 for version 13 and fix pack 12.0.12.28 for version 12.
- Same bulletin: IBM's bulletin covers two CVEs, this one and CVE-2026-14519, which it describes as an arbitrary file read and arbitrary changes to configuration settings.
- Severity: 8.8 with the record's CWE-78 (OS command injection). Not on the CISA Known Exploited Vulnerabilities list. IBM lists no workarounds.
How to check if you're exposed
Check the installed version on each integration node and server host. IBM provides a command that prints the version of the installation:
mqsiservice -v
Run it from the environment set up by the product's profile script. Compare the output with the ranges above. In containerized deployments, check the image tag of the App Connect container, since the version inside the image is what runs.
Also list who and what can reach the product's administration and integration ports. The bulletin describes a remote attacker, so network exposure decides how urgent this is. An integration server reachable only from a few internal systems is a lower exposure than one reachable from the internet or from a large shared network.
What to do now
- List every App Connect Enterprise installation with its version, including development, test and container based ones.
- Apply fix pack 13.0.8.0 to version 13 installations, or 12.0.12.28 to version 12 installations.
- Restrict network access to administration and integration ports to the systems that need them.
- Review the related CVE-2026-14519 in the same bulletin, which the same fix pack addresses.
- Check integration server logs from before the fix for unexpected commands or configuration changes.
Why it matters
The record classifies the flaw as CWE-78, improper neutralization of special elements used in an OS command. IBM describes the specific special characters as CRLF, the carriage return and line feed pair that separates lines in many text protocols. When software passes input that contains them into a place where line breaks mean something, the input can add instructions that the author never intended.
IBM gives few details, and that is typical of vendor bulletins. What you can rely on is the scope: two supported version lines, a single APAR, and a fix delivered as a fix pack. The score of 8.8 reflects network access with low complexity. The vector in the record indicates that privileges are required, so an attacker would need some level of access first. Treat the network and the accounts that can reach the product as part of your exposure.
Integration servers are a sensitive place for this kind of bug. They sit between systems, hold credentials for many of them, and often run with broad permissions. A flaw that lets someone run commands on that host can turn into access to everything the host can reach.
When you patch, read the second CVE in the bulletin too. The same fix pack addresses an arbitrary file read and unauthorized configuration changes, and teams sometimes close one CVE ticket and forget the other. Confirm the version afterward and attach it to the record.
Quick check
Is a workaround available?
IBM's bulletin lists none. The remedy is the fix pack that contains APAR IT49745.
Does the fix cover both CVEs in the bulletin?
The bulletin presents one APAR and one set of fix packs for the vulnerabilities it describes. Check the bulletin text for the exact wording before you close tickets.
Sources
Last reviewed: 19 October 2026.
