A high-severity XML external entity vulnerability in IBM App Connect Enterprise and Integration Bus for z/OS allows authenticated attackers to potentially access sensitive system files.

This flaw is an XML external entity (XXE) injection vulnerability (CWE-611) within the SAP Adapter component. An authenticated attacker can leverage this weakness to force the application to process malicious XML input, leading to the unauthorized exposure of internal data.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive internal information, including configuration files or system data accessible to the application process. With a CVSS score of 7.7, this is a significant risk that could result in data compromise and potential regulatory non-compliance. The ability to perform cross-site or cross-component data exfiltration increases the overall threat level to the host infrastructure.

Immediate Action: Apply the vendor-provided security fixes immediately, specifically updating to IBM App Connect Enterprise Fix Pack 13.0.8.2 or the relevant APAR (IT49773) for your specific deployment version as detailed in the IBM support advisory.

Proactive Monitoring: Monitor system and application access logs for unusual XML-based requests or attempts to access restricted system files via the SAP Adapter interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XML parsing inspection capabilities to identify and block malicious external entity references in incoming payloads.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for unauthorized data access, organizations should prioritize the deployment of the provided IBM patches. Ensure that all instances of App Connect Enterprise and Integration Bus for z/OS are audited for the affected versions and that the necessary fix packs are applied during the next scheduled maintenance window or sooner if the environment is exposed to untrusted network input.