4.2
Medium
CVE-2026-18195 IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection
Description
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NExploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| App Connect Enterprise 13.0 | 13.0.1.0 → 13.0.8.2 | No fix stated |
| App Connect Enterprise 12.0 | 12.0.1.0 → 12.0.12.30 | No fix stated |
Other CVEs of App Connect Enterprise
The 39 CVEs of App Connect Enterprise →
CVE-2026-18196
IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection
5.4
Medium
CVE-2026-18194
IBM App Connect Enterprise is vulnerable to a clickjacking attack
2.5
Low
CVE-2026-18093
IBM App Connect Enterprise is vulnerable to a credential exposure
7.5
High
CVE-2026-17437
IBM App Connect Enterprise is vulnerable to an arbitrary file write
5.5
Medium