The CVSS 7.5 score for CVE-2026-12947 is a deceptive floor. App Connect Enterprise functions as a message broker and integration hub — it authenticates to backend systems using credentials, manages connection strings to databases and APIs, and processes the actual business payloads exchanged between applications. A log file on this product doesn't capture debug noise; it captures the keys to your operations. That's why 'potentially sensitive information' is doing significant analytical work in the advisory — IBM's hedging language suggests they may not have done the forensic work to identify exactly what categories leaked, or worse, the answer is 'everything we process.'
The 'local user' constraint is narrower than it appears in theory and broader in practice. In enterprise deployments, the people with filesystem access to ACE nodes aren't random employees — they're administrators, DevOps engineers, support staff, monitoring agents, and service accounts. The attack surface is everyone with privileged access to production systems, which is a substantial scope. More critically, the real risk isn't the local file read itself — it's the pivot path. A credential harvested from an ACE log file doesn't stay in the log file. It unlocks the downstream ERP, database, or payment processor on the other side of that integration flow. The blast radius extends far beyond the vulnerable system.
The version persistence is the most revealing detail. The flaw exists across 12.0.x and 13.0.x — both branches required patching. If the logging subsystem wasn't revisited during a major version transition (13.0), the fix is almost certainly a pattern-match redaction rule — 'don't log Authorization headers' — rather than a fundamental redesign of log verbosity controls. That's the same architectural approach TIBCO and MuleSoft applied to similar vulnerabilities, and it leaves the door open for recurrence in future releases.
There's also a structural detection gap: this vulnerability has no exploitation signature. The 'attack' is reading a file that legitimately exists on the filesystem. Standard vulnerability scanners don't flag 'log file contains database password' because that's not a vulnerability pattern their models recognize. Organizations likely sat on this exposure for years without automated detection surfacing it.
Check your ACE deployments: verify you are on 12.0.12.27 or later, or 13.0.7.2 or later. But patching alone is insufficient — the fix stops new exposure, but credentials written to disk during the vulnerable period remain in historical log files unless explicitly purged. Review your log rotation and retention policies, and consider whether historical logs from vulnerable versions may contain credentials that are still valid. The temporal gap between 'patched' and 'actually remediated' could be years, and that's the gap that matters.