CVE-2026-78543 is a medium severity (CVSS 5.3) denial of service in IBM App Connect Enterprise 12 and 13 and IBM Integration Bus for z/OS 10.1. A remote attacker can trigger an infinite loop. IBM fixed it in 13.0.8.2 and 12.0.12.29, with an interim fix for z/OS.
What's affected
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, IBM App Connect Enterprise 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7.
IBM's fixes, tracked under APAR IT49773: fix pack 13.0.8.2 for the version 13 line, fix pack 12.0.12.29 for the version 12 line, and an interim fix for 10.1.0.7 on IBM Integration Bus for z/OS from Fix Central. IBM lists no workarounds.
This is a combined bulletin that covers many App Connect Enterprise CVEs, including XML external entity and credential logging issues, so the same fix packs address more than this one entry.
How to check if you're exposed
On a distributed system, ask the product for its version.
mqsiservice -v
The command can vary by version and platform, so if it does not work, use the version shown in the web user interface, the installation directory name or the Toolkit's About dialog. On z/OS, check your installed service level against 10.1.0.7. Make a list of integration nodes and servers, because each runs its own install.
What to do now
- Apply fix pack 13.0.8.2 or 12.0.12.29 as appropriate, or the interim fix for APAR IT49773 on IBM Integration Bus for z/OS.
- Plan the maintenance window for all integration nodes. A rolling restart is the usual approach when you have redundancy.
- Limit network access to the integration server ports to the systems that need them.
- Review the other CVEs in the same bulletin, as the fix packs address several at once.
Why it matters
The class is CWE-835, a loop with an unreachable exit condition. A remote request puts the code into a state where it keeps repeating and never finishes, tying up a processing thread. Repeat the request and an attacker can use up enough capacity to slow or stop message flows. The vector shows no confidentiality or integrity impact.
Integration platforms sit in the middle of many business processes, so even a low-severity availability bug can have a wide blast radius when it stalls the pipe between systems. IBM's bulletin does not describe the exact trigger, so we do not either. The record shows no KEV flag and no exploitation report.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is data at risk?
The record rates impact on availability only, with none on confidentiality or integrity.
Is there a workaround?
IBM's bulletin lists none. Apply the fix.
Sources
Last reviewed: 18 October 2026.
