low · CVSS v3 2.5

CVE-2026-18194

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 lack anti-clickjacking protections, allowing remote attackers to perform unaut

Overview

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 lack anti-clickjacking protections, allowing remote attackers to perform unauthorized actions via UI manipulation. This vulnerability affects the web interface of the integration platform. It is rated low severity due to the specific conditions required for exploitation.

Description

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

Impact

Confidentiality and integrity may be compromised if an attacker successfully tricks an authenticated user into interacting with a maliciously framed interface. Availability is generally not impacted. The primary risk is to administrators or users with access to the App Connect Enterprise web console. Impact is limited to the specific web application context where clickjacking can be executed.

Remediation

Apply the latest security patch or update to a version of IBM App Connect Enterprise that includes anti-clickjacking headers (such as X-Frame-Options or Content-Security-Policy frame-ancestors). If immediate patching is not possible, configure a reverse proxy or web application firewall to inject these protective headers into HTTP responses from the application. Restrict network access to the web interface to trusted administrative networks only.

Risk context

The CVSS v3 score of 2.5 indicates low severity, and no EPSS score is available to suggest high exploitation likelihood. This issue should be addressed during regular maintenance cycles rather than as an emergency response. The risk is primarily theoretical unless specific user interaction conditions are met.

Affected products

  • IBM App Connect Enterprise 13.0.1.0
  • IBM App Connect Enterprise 13.0.8.2

Scores

Severity
low
CVSS v2
1.2
CVSS v3
2.5
CVSS v4
—
EPSS
—

clickjacking IBM App Connect Enterprise web-security low-severity

← All CVEs

Related CVEs

low

CVE-2026-109808

Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certain conditions, as the attacker must have prior knowledge of specific internal identifiers to successfully target the affected functionality. Successful exploitation could allow the attacker to read sensitive information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

low

CVE-2026-13387

A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions.

View analysis

low

CVE-2025-0166

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4-4.8.5 and 5.0.0-5.4.2 can expose sensitive source code that should not be publicly accessible. This vulnerability allows attackers to read internal code, potentially revealing business logic or proprietary algorithms. It is a low-severity issue but still poses a confidentiality risk.

View analysis

low

CVE-2026-102618

IBM i 7.6, 7.5, 7.4, and 7.3 allow an authenticated user to indirectly disable system auditing, potentially enabling malicious insiders to hide activity. The vulnerability is low severity but can undermine audit integrity. Defenders should address it promptly to preserve audit logs.

View analysis