CVE-2016-9706: IBM Integration Bus

Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days.

IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918.

Affected products

• IBM Integration Bus: version 9.0 only; version 10.0 only
• IBM WebSphere Message Broker: version 8.0 only

Published 2017-02-15. Last modified 2026-06-17.