CVE-2026-18194
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
Risk Assessment
Missing clickjacking protection may allow an attacker to trick a user into performing unintended actions in the application. This may lead to unauthorized changes or data disclosure.
Recommendation
Update IBM App Connect Enterprise to a version containing the anti-clickjacking fix. Until then, consider deploying X-Frame-Options or Content-Security-Policy headers.
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-18196Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
- CVE-2026-18195Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
- CVE-2026-18093High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 has broken access control, allowing a remote attacker to obtain sensitive information.
- CVE-2026-17437Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
- CVE-2026-17416High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17156High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17133High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-75624High
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.27 allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS