CVE-2026-18196 · Vendor
NO FIX YET
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 fail to neutralize output, so a remote attacker can inject arbitrary HTML. The sources do not describe the exact impact beyond HTML injection.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running IBM App Connect Enterprise in the listed version ranges. The sources do not say which interfaces or configurations expose the injection, so unknown.
Who cares ibm-app-connect-enterprise, integration
No fix yet, per the sources.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.