CVE-2025-13490: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality

Published Mar 2, 2026
·
Updated

IBM App Connect Enterprise Certified Container transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

Other sources

IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Certified Containers Operands versions CD 12.0.11.2‑r1 through 12.0.12.5‑r1 and 13.0.1.0‑r1 through 13.0.6.1‑r1, and LTS versions 12.0.12‑r1 through 12.0.12‑r20, contain a vulnerability in which the IBM App Connect Enterprise Certified Container transmits data in clear text, potentially allowing an attacker to intercept and obtain sensitive information through man‑in‑the‑middle techniques.

— NVD

Affected Software

52 affected components
IBM App Connect Operator>=11.3.0<=11.6.0, >=12.1.0<=12.20.0, >=12.0.0<=12.0.20
IBM App Connect Enterprise Certified Containers Operands>=12.0.11.2‑r1<=12.0.12.5‑r1, >=13.0.1.0‑r1<=13.0.6.1‑r1, >=12.0.12‑r1<=12.0.12‑r20
IBM App Connect Operator<=CD: 11.3.0 - 11.6.0, 12.1.0 - 12.20.1 12.0 LTS: 12.0.0 - 12.0.20
IBM App Connect EnterpriseCertified Containers Operands<=CD: 12.0.11.2-r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.1-r1 12.0 LTS: 12.0.12-r1 - 12.0.12-r20
IBM App Connect Enterprise Certified Containers Operands=12.0.11.2-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.11.3-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r10
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r11
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r12
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r13
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r14
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r15
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r16
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r17
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r18
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r19
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r2
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r20
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r3
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r4
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r5
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r6
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r7
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r8
IBM App Connect Enterprise Certified Containers Operands=12.0.12-r9
IBM App Connect Enterprise Certified Containers Operands=12.0.12.0-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12.0-r2
IBM App Connect Enterprise Certified Containers Operands=12.0.12.2-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12.3-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12.4-r1
IBM App Connect Enterprise Certified Containers Operands=12.0.12.5-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.1.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.1.0-r2
IBM App Connect Enterprise Certified Containers Operands=13.0.1.1-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.2.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.2.1-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.2.2-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.2.2-r2
IBM App Connect Enterprise Certified Containers Operands=13.0.3.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.3.1-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.4.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.4.1-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.4.2-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.5.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.5.1-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.5.2-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.6.0-r1
IBM App Connect Enterprise Certified Containers Operands=13.0.6.1-r1
IBM App Connect Operator>=11.3.0<=11.6.0
IBM App Connect Operator>=12.0.0<=12.0.20
IBM App Connect Operator>=12.1.0<=12.20.1

Remediation

Information

IBM strongly suggests the following: App Connect Enterprise Certified Container up to 12.20.1 (Continuous Delivery) Upgrade to App Connect Enterprise Certified Container Operator version 12.21.0 or higher, and ensure that all DesignerAuthoring, IntegrationServer and IntegrationRuntime components are at 13.0.6.2-r1 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator App Connect Enterprise Certified Container 12.0 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 12.0.21 or higher, and ensure that all DesignerAuthoring, IntegrationServer and IntegrationRuntime components are at 12.0.12-r21 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releases

Event History

Mar 2, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Mar 3, 2026
CVE Published
via MITRE·07:58 PM
Data Sourced
via MITRE·07:58 PM
RemedyDescriptionSeverity
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-13490?

CVE-2025-13490 is considered a high severity vulnerability due to the potential for loss of confidentiality of sensitive information.

2

How do I fix CVE-2025-13490?

To fix CVE-2025-13490, update to the latest version of the IBM App Connect Enterprise Certified Container or App Connect Operator that addresses this vulnerability.

3

What are the affected versions in CVE-2025-13490?

CVE-2025-13490 affects IBM App Connect Operator versions between 11.3.0 and 11.6.0, and several versions of the IBM App Connect Enterprise Certified Containers Operands.

4

What kind of data is at risk in CVE-2025-13490?

CVE-2025-13490 could allow attackers to obtain sensitive information transmitted in clear text.

5

How can I ensure I am not vulnerable to CVE-2025-13490?

To ensure you are not vulnerable to CVE-2025-13490, verify your IBM App Connect installations are running the patched versions released by IBM.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203