CVE-2026-17440: IBM App Connect Enterprise DOS Vulnerability

CVE-2026-17440 Overview

CVE-2026-17440 is a denial-of-service vulnerability affecting IBM App Connect Enterprise and IBM Integration Bus for z/OS. The flaw stems from uncontrolled recursion [CWE-674] that a local, authenticated attacker can trigger to exhaust process resources. Successful exploitation crashes the integration runtime and disrupts message flows served by the affected node.

Critical Impact
A local attacker with low privileges can crash IBM App Connect Enterprise or Integration Bus runtimes by triggering uncontrolled recursion, halting integration workloads until the process restarts.

Affected Products

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28
IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7

Discovery Timeline

2026-09-04 - CVE-2026-17440 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17440

Vulnerability Analysis

The vulnerability is classified under [CWE-674: Uncontrolled Recursion]. Affected IBM App Connect Enterprise and Integration Bus for z/OS versions process specific inputs through recursive routines that lack a bounded termination condition. When recursion depth grows without limit, the runtime consumes stack memory until the process aborts.

The attack requires local access with valid low-privileged credentials on the host running the integration node. No user interaction is needed, and complexity is low. Only availability is impacted; confidentiality and integrity remain intact based on the published CVSS vector.

Root Cause

Recursive processing paths inside the App Connect Enterprise runtime do not enforce a maximum call depth. An attacker who can submit crafted content to the local process forces the runtime to recurse until stack exhaustion. The condition terminates the integration server, dropping in-flight message flows and connected endpoints.

Attack Vector

Exploitation is limited to local users authorized to interact with the integration node. The attacker submits crafted data that reaches the vulnerable recursive routine within App Connect Enterprise or Integration Bus for z/OS. See the IBM Support Document for vendor-specific technical detail on the affected component and inputs.

No public proof-of-concept exploit is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17440

Indicators of Compromise

Unexpected termination or restart of IntegrationServer or DataFlowEngine processes on hosts running affected App Connect Enterprise versions.
Stack overflow errors, SIGSEGV, or abend records in IBM App Connect Enterprise logs or z/OS system logs for Integration Bus.
Repeated crash-and-restart cycles of an integration node correlated with a specific local user session.

Detection Strategies

Monitor App Connect Enterprise trace and event logs for recursion depth warnings, stack exhaustion messages, and abnormal flow termination events.
Correlate local user activity with integration server restarts to identify unauthorized interaction with the runtime.
Ingest host telemetry into a centralized analytics platform and alert on repeated process crashes of the App Connect Enterprise runtime.

Monitoring Recommendations

Track process uptime and crash counts for IntegrationServer instances and z/OS Integration Bus address spaces.
Audit local access to hosts running App Connect Enterprise, including shell sessions and administrative commands executed against the runtime.
Alert on stack memory anomalies and unusual CPU spikes on integration hosts that precede process termination.

How to Mitigate CVE-2026-17440

Immediate Actions Required

Apply the fixes referenced in the IBM Support Document for App Connect Enterprise 12 and 13, and for Integration Bus for z/OS 10.1.
Inventory hosts running affected versions and prioritize patching for systems accessible to multiple local users.
Restrict local interactive and shell access to integration node hosts to a minimal set of administrators.

Patch Information

IBM has published remediation guidance in the vendor advisory. Upgrade IBM App Connect Enterprise beyond 13.0.8.1 and 12.0.12.28, and IBM Integration Bus for z/OS beyond 10.1.0.7, using the fix packs listed in the IBM Support Document.

Workarounds

Limit local logon rights on integration hosts to trusted administrators until patches are deployed.
Enforce operating system resource limits, such as stack size caps, to reduce the blast radius of runaway recursion.
Configure automated restart and health monitoring for the integration node so denial-of-service impact is minimized.

bash

# Example: restrict stack size for the App Connect Enterprise runtime user
ulimit -s 8192
# Confirm current process limits before starting the integration server
ulimit -a