CVE-2026-114468: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Published Nov 13, 2026

Updated

IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade App Connect Enterprise Certified Container Operator to a version that resolves this vulnerability.
Fixed in 12.0.29
Upgrade
Upgrade App Connect Enterprise Certified Container components to a version that resolves this vulnerability.
Fixed in 12.0.12-r29
Upgrade
Upgrade App Connect Enterprise Certified Container Operator to a version that resolves this vulnerability.
Fixed in 13.7.0
Upgrade
Upgrade App Connect Enterprise Certified Container components to a version that resolves this vulnerability.
Fixed in 13.0.9.1-r1

Event History

Nov 13, 2026

CVE Published

via MITRE·09:59 PM

Data Sourced

via MITRE·09:59 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Deployments using IBM App Connect Operator and App Connect Enterprise Certified Container operands are exposed if an attacker can run HTTP calls from within a running container.

What access does an attacker need to exploit it?

The attacker needs the ability to make HTTP calls within the running container. The supplied information does not indicate that remote external access alone is sufficient.

What could exploitation allow?

An attacker meeting the access requirement could make administrative calls to a running IntegrationRuntime. The reported impact includes loss of confidentiality and denial of service, with integrity and availability rated high in the supplied vector.

CVE-2026-114468: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit it?

What could exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What access does an attacker need to exploit it?

What could exploitation allow?