CVE-2026-18196
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
Risk Assessment
This could lead to cross-site scripting (XSS) attacks and compromise the security of application users.
Recommendation
Update IBM App Connect Enterprise to a patched version and review output encoding mechanisms.
Other vulnerabilities in IBM App Connect Enterprise
See all- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-15435Critical
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 are vulnerable to remote directory traversal. An attacker can send a specially crafted URL containing '/../' sequences to write arbitrary files on the system.
- CVE-2026-18195Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
- CVE-2026-18194Low
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
- CVE-2026-18093High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 has broken access control, allowing a remote attacker to obtain sensitive information.
- CVE-2026-17437Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
- CVE-2026-17416High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17156High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.
- CVE-2026-17133High
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-75624High
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.27 allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.
Original NVD description (English source)
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS