# Source: Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

IBM: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

**IBM** · [https://www.ibm.com/support/pages/node/7294053](https://www.ibm.com/support/pages/node/7294053) · published 2026-10-26 · added by `breaking@php.newsroom (curator's role)` · slug `ibm-node-7294053`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). IBM security bulletin ('26 Oct 2026: Initial Publication') for IBM App Connect Enterprise Toolkit.

## What it says, as the collector read it

#### Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/ibm/ibm-node-7294053`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

IBM security bulletin ('26 Oct 2026: Initial Publication') for IBM App Connect Enterprise Toolkit.

> Security Bulletin: IBM App Connect Enterprise Toolkit is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

> 13.0.1.0 - 13.0.9.0

> 12.0.1.0 - 12.0.12.31

> This ifix disables pattern generation using the PHP API for user-defined patterns.

> 26 Oct 2026: Initial Publication

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): IBM security bulletin: IBM App Connect Enterprise Toolkit pattern generation using a PHP API is vulnerable to CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2).

Supports: vendor response: products affected / not affected; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:50Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://www.ibm.com/support/pages/node/7294053- `headers.json` 8246aa8dba1627df00672fd0c6c7a9fcad42c44489de377dead41be1d9576512 2,043 bytes
- `page.html` a1bb1bc5f1c4e7989173accdbe78de0df4dd1062aca2147081efba2565691e36 56,046 bytes
- `provenance.json` 13538fec0aaabe65fb371b4b6484b8bf81a69e92781eef522f050c21a8db5f5a 1,642 bytes
- `rendered.html` 1a8d0f0ad8029f9f5b1879fd7bad051e89b3a7739358d6d783269a994b933577 136,609 bytes
- `screenshot.jpg` 670509ab2f9981fcc8700dcc96ee06edf3a95b081375a58a5a7397c13f67d5e2 344,580 bytes
- `text.txt` d03adc4886dc19df7f7e84e6541b36fe6e7ac521613fc7d3961aa09de0a76573 6,633 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/ibm-node-7294053/index.html