{"id":"CVE-2026-18195","kind":"vulnerability","aliases":["CVE-2026-18195"],"related":[],"title":"IBM App Connect Enterprise: error messages allow remote content spoofing","description":"IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 do not encode error message output properly. A remote attacker can use this to spoof content shown to a user.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","ibm-app-connect-enterprise","integration","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed IBM App Connect Enterprise version against the affected ranges (`13.0.1.0` to `13.0.8.2`, `12.0.1.0` to `12.0.12.30`)","fix":null,"status":"open","published_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:23:05+00:00","updated_at":"2026-11-08T18:23:05+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T18:23:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"IBM App Connect Enterprise: error messages allow remote content spoofing","impact":"low","summary":"IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 do not encode error message output properly. A remote attacker can use this to spoof content shown to a user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-app-connect-enterprise","integration","enterprise"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker spoofs content shown in error messages to users","analyst_note":"","how_to_check":"- Check the installed IBM App Connect Enterprise version against the affected ranges (`13.0.1.0` to `13.0.8.2`, `12.0.1.0` to `12.0.12.30`)\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM App Connect Enterprise in the affected version ranges that return error messages to remote callers. The sources do not say which deployment settings expose the error output. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4558,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18195':13A,16A '-2026':12A,15A '12.0.1.0':34B,65C '12.0.12.30':36B,67C '13.0.1.0':30B,61C '13.0.8.2':32B,63C 'allow':7A,69C 'app':2A,20B,26B,58C 'attack':46B,72C 'connect':3A,21B,27B,59C 'content':9A,52B,75C 'could':68C 'cve':11A,14A 'due':77C 'encod':39B,81C 'enterpris':4A,17B,22B,28B,60C 'error':5A,40B,83C 'ibm':1A,19B,25B,57C 'ibm-app-connect-enterpris':18B 'improp':79C 'integr':23B 'messag':6A,41B,84C 'output':42B,80C 'perform':74C 'proper':43B 'remot':8A,45B,71C 'shown':53B 'spoof':10A,51B,76C 'use':48B 'user':56B 'vendor':24B 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM App Connect Enterprise in the affected version ranges that return error messages to remote callers. The sources do not say which deployment settings expose the error output. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["enterprise","ibmappconnectenterprise","integration","medium","vendor"],"campaign_type":null,"search_a":"'-18195':13A,16A '-2026':12A,15A 'allow':7A 'app':2A 'connect':3A 'content':9A 'cve':11A,14A 'enterpris':4A 'error':5A 'ibm':1A 'messag':6A 'remot':8A 'spoof':10A","search_b":"'12.0.1.0':34B '12.0.12.30':36B '13.0.1.0':30B '13.0.8.2':32B 'app':20B,26B 'attack':46B 'connect':21B,27B 'content':52B 'encod':39B 'enterpris':17B,22B,28B 'error':40B 'ibm':19B,25B 'ibm-app-connect-enterpris':18B 'integr':23B 'messag':41B 'output':42B 'proper':43B 'remot':45B 'shown':53B 'spoof':51B 'use':48B 'user':56B 'vendor':24B 'version':29B","search_c":"'12.0.1.0':65C '12.0.12.30':67C '13.0.1.0':61C '13.0.8.2':63C 'allow':69C 'app':58C 'attack':72C 'connect':59C 'content':75C 'could':68C 'due':77C 'encod':81C 'enterpris':60C 'error':83C 'ibm':57C 'improp':79C 'messag':84C 'output':80C 'perform':74C 'remot':71C 'spoof':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18195","severity":null,"published_at":"2026-11-08T18:17:03+00:00","modified_at":"2026-11-08T18:17:03+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}