SB2026081925 - Multiple vulnerabilities in IBM App Connect for Manufacturing



SB2026081925 - Multiple vulnerabilities in IBM App Connect for Manufacturing

Published: August 19, 2026

Security Bulletin ID SB2026081925
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-50010)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper certificate validation in X509TrustManagerWrapper within netty-handler when establishing client TLS connections with a user-supplied plain X509TrustManager. A remote attacker can present a certificate for an unexpected hostname to disclose sensitive information.

The issue occurs because hostname verification is not performed in this configuration, even when HTTPS endpoint identification is expected by default.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-50020)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in HttpObjectDecoder when parsing requests with non-CRLF control characters before the request-line. A remote attacker can send a specially crafted request to smuggle HTTP requests.

The issue can cause request-boundary confusion when a front-end component interprets the prepended bytes differently in pipelined or multiplexed transports.


3) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-45416)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in SslClientHelloHandler.decode() when processing a TLS ClientHello that does not fit in the first record. A remote attacker can send a specially crafted ClientHello with a large handshake length to cause a denial of service.

The issue is exposed by the commonly used SniHandler and AbstractSniHandler constructors because they disable the client hello length guard and do not schedule a handshake timeout.


4) Incorrect Comparison (CVE-ID: CVE-2026-44249)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass IPv6 subnet access controls.

The vulnerability exists due to incorrect comparison in IpSubnetFilterRule.compareTo() when evaluating IPv6 subnet rules. A remote attacker can use a valid public IP address to bypass IPv6 subnet access controls.

The issue is caused by applying a bitwise AND operation to the configured networkAddress instead of the subnetMask.


Remediation

Install update from vendor's website.