{"id":"CVE-2026-18093","kind":"vulnerability","aliases":["CVE-2026-18093"],"related":[],"title":"IBM App Connect Enterprise: broken access control leaks sensitive information remotely","description":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 have a broken access control flaw. A remote attacker can obtain sensitive information from the product.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM App Connect Enterprise","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-app-connect-enterprise","integration-middleware","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed App Connect Enterprise version against the affected range 13.0.1.0 through 13.0.8.2","fix":"- Move to a version outside the range 13.0.1.0 through 13.0.8.2; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:38+00:00","updated_at":"2026-11-08T18:22:38+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T18:22:38Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version outside the range 13.0.1.0 through 13.0.8.2; the exact fixed version is unknown from the sources","reach":"network","title":"IBM App Connect Enterprise: broken access control leaks sensitive information remotely","impact":"medium","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 have a broken access control flaw. A remote attacker can obtain sensitive information from the product.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-app-connect-enterprise","integration-middleware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker reads sensitive information from the integration server","analyst_note":"Find the IBM security bulletin for CVE-2026-18093 to confirm the fixed version, the affected component and whether authentication is required.","how_to_check":"- Check the installed App Connect Enterprise version against the affected range 13.0.1.0 through 13.0.8.2\n- unknown beyond that: the sources do not say which configuration or endpoint is involved","plain_action":"","product_name":"IBM App Connect Enterprise","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organisations running IBM App Connect Enterprise in the affected version range 13.0.1.0 through 13.0.8.2 are exposed. The sources do not say which component or configuration exposes the data, so the exact exposure path is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000747,"input_tokens":4521,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-18093':14A,17A '-2026':13A,16A '13.0.1.0':36B,59C '13.0.8.2':38B,61C 'access':6A,42B,74C 'allow':63C 'app':2A,19A,24B,32B,56C 'attack':47B,66C 'broken':5A,41B,73C 'connect':3A,20A,25B,33B,57C 'control':7A,43B,75C 'could':62C 'cve':12A,15A 'due':71C 'enterpris':4A,26B,34B,58C 'enterprise':21A 'flaw':44B 'ibm':1A,18A,23B,31B,55C 'ibm-app-connect-enterpris':22B 'inform':10A,51B,70C 'integr':28B 'integration-middlewar':27B 'leak':8A 'middlewar':29B 'obtain':49B,68C 'product':54B 'remot':11A,46B,65C 'sensit':9A,50B,69C 'vendor':30B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Organisations running IBM App Connect Enterprise in the affected version range 13.0.1.0 through 13.0.8.2 are exposed. The sources do not say which component or configuration exposes the data, so the exact exposure path is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["appconnectenterprise","ibmappconnectenterprise"],"ptokens":["app","connect","enterprise","ibm"],"labels":["high","ibmappconnectenterprise","integrationmiddleware","vendor"],"campaign_type":null,"search_a":"'-18093':14A,17A '-2026':13A,16A 'access':6A 'app':2A,19A 'broken':5A 'connect':3A,20A 'control':7A 'cve':12A,15A 'enterpris':4A 'enterprise':21A 'ibm':1A,18A 'inform':10A 'leak':8A 'remot':11A 'sensit':9A","search_b":"'13.0.1.0':36B '13.0.8.2':38B 'access':42B 'app':24B,32B 'attack':47B 'broken':41B 'connect':25B,33B 'control':43B 'enterpris':26B,34B 'flaw':44B 'ibm':23B,31B 'ibm-app-connect-enterpris':22B 'inform':51B 'integr':28B 'integration-middlewar':27B 'middlewar':29B 'obtain':49B 'product':54B 'remot':46B 'sensit':50B 'vendor':30B 'version':35B","search_c":"'13.0.1.0':59C '13.0.8.2':61C 'access':74C 'allow':63C 'app':56C 'attack':66C 'broken':73C 'connect':57C 'control':75C 'could':62C 'due':71C 'enterpris':58C 'ibm':55C 'inform':70C 'obtain':68C 'remot':65C 'sensit':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18093","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18093","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}