CVE-2026-18194 · Vendor
NO FIX YET
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 lack anti-clickjacking protections. A remote attacker could trick a logged-in user into clicking hidden page elements and perform unauthorized actions.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM App Connect Enterprise in the affected version range are exposed through its web administration interfaces. The sources do not say which pages or configurations are affected, or whether non-browser or API-only use is affected. unknown
Not affected if outside-version-range
Who cares ibm-app-connect-enterprise, self-hosted
13.0.1.0 through 13.0.8.2No fix yet, per the sources.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.