{"id":"CVE-2026-18194","kind":"vulnerability","aliases":["CVE-2026-18194"],"related":[],"title":"IBM App Connect Enterprise: missing anti-clickjacking controls allow unauthorized actions","description":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 lack anti-clickjacking protections. A remote attacker could trick a logged-in user into clicking hidden page elements and perform unauthorized actions.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-app-connect-enterprise","self-hosted","vendor"],"not_affected_if":["outside-version-range"],"how_to_check":"- Confirm whether your team runs IBM App Connect Enterprise and check the installed version against `13.0.1.0` through `13.0.8.2`","fix":null,"status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:23:07+00:00","updated_at":"2026-11-08T18:23:07+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T18:23:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM App Connect Enterprise: missing anti-clickjacking controls allow unauthorized actions","impact":"low","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 lack anti-clickjacking protections. A remote attacker could trick a logged-in user into clicking hidden page elements and perform unauthorized actions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-app-connect-enterprise","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs unauthorized actions as a tricked logged-in user","analyst_note":"Check the IBM security bulletin for affected interfaces, the fixed version and any mitigation setting.","how_to_check":"- Confirm whether your team runs IBM App Connect Enterprise and check the installed version against `13.0.1.0` through `13.0.8.2`\n- unknown beyond this: the sources do not say which admin interface or setting is affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-version-range"],"who_is_affected":"Teams running IBM App Connect Enterprise in the affected version range are exposed through its web administration interfaces. The sources do not say which pages or configurations are affected, or whether non-browser or API-only use is affected. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000721,"input_tokens":4531,"output_tokens":536,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-18194':15A,18A '-2026':14A,17A '13.0.1.0':33B,64C '13.0.8.2':35B,66C 'action':12A,59B,75C 'allow':10A,68C 'anti':7A,38B,80C 'anti-clickjack':6A,37B,79C 'app':2A,21B,29B,61C 'attack':43B,71C 'click':52B 'clickjack':8A,39B,81C 'connect':3A,22B,30B,62C 'control':9A,82C 'could':44B,67C 'cve':13A,16A 'due':76C 'element':55B 'enterpris':4A,23B,31B,63C 'hidden':53B 'host':26B 'ibm':1A,20B,28B,60C 'ibm-app-connect-enterpris':19B 'lack':36B 'log':48B 'logged-in':47B 'miss':5A,78C 'page':54B 'perform':57B,73C 'protect':40B 'remot':42B,70C 'self':25B 'self-host':24B 'trick':45B 'unauthor':11A,58B,74C 'user':50B 'vendor':27B 'version':32B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM App Connect Enterprise in the affected version range are exposed through its web administration interfaces. The sources do not say which pages or configurations are affected, or whether non-browser or API-only use is affected. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmappconnectenterprise","low","selfhosted","vendor"],"campaign_type":null,"search_a":"'-18194':15A,18A '-2026':14A,17A 'action':12A 'allow':10A 'anti':7A 'anti-clickjack':6A 'app':2A 'clickjack':8A 'connect':3A 'control':9A 'cve':13A,16A 'enterpris':4A 'ibm':1A 'miss':5A 'unauthor':11A","search_b":"'13.0.1.0':33B '13.0.8.2':35B 'action':59B 'anti':38B 'anti-clickjack':37B 'app':21B,29B 'attack':43B 'click':52B 'clickjack':39B 'connect':22B,30B 'could':44B 'element':55B 'enterpris':23B,31B 'hidden':53B 'host':26B 'ibm':20B,28B 'ibm-app-connect-enterpris':19B 'lack':36B 'log':48B 'logged-in':47B 'page':54B 'perform':57B 'protect':40B 'remot':42B 'self':25B 'self-host':24B 'trick':45B 'unauthor':58B 'user':50B 'vendor':27B 'version':32B","search_c":"'13.0.1.0':64C '13.0.8.2':66C 'action':75C 'allow':68C 'anti':80C 'anti-clickjack':79C 'app':61C 'attack':71C 'clickjack':81C 'connect':62C 'control':82C 'could':67C 'due':76C 'enterpris':63C 'ibm':60C 'miss':78C 'perform':73C 'remot':70C 'unauthor':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18194","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}