CVE-2026-78543

IBM App Connect Enterprise and IBM Integration Bus for z/OS contain a denial-of-service flaw (CWE-835, infinite loop) in which network input can drive the software into an endless processing loop. A remote, unauthenticated attacker with network reachability to an affected integration node can trigger the loop with low-complexity requests (the advisory does not name a specific protocol or endpoint), consuming CPU until the service is restarted. The impact is availability only — no data disclosure or tampering — but successful attacks can take down message flows and the business integrations that depend on them. Organizations running ACE 13.0.1.0–13.0.8.1, ACE 12.0.1.0–12.0.12.28, or Integration Bus for z/OS 10.1.0.0–10.1.0.7 are affected. There is currently no public proof of concept, no KEV listing, and a low EPSS score (0.4%), indicating no known exploitation in the wild.

What to do: Upgrade App Connect Enterprise and Integration Bus for z/OS to a fix level beyond the affected ranges using the fix packs listed in IBM's security bulletin for your stream (13.0.x, 12.0.x, and 10.1 for z/OS); the bulletin's fix list gives the exact fixed versions. Until patched, restrict network access to integration node and HTTP listener ports and monitor integration servers for sustained high CPU, which may indicate a looping process. No exploitation is known, so internal systems can follow normal patch cycles, but prioritize any instance reachable from untrusted networks.