CVE-2026-18194: IBM App Connect Enterprise is vulnerable to a clickjacking attack

Q: Which deployments are affected?

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 are identified as affected.

Q: What must happen for exploitation to succeed?

The attack requires user interaction. The attacker would need to use the missing anti-clickjacking controls to induce a user to perform unauthorized actions.

Q: Does exploitation require prior authentication or local access?

The supplied vector indicates no privileges are required and the attack can be performed remotely. It also indicates high attack complexity.

Published Oct 9, 2026

Updated

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

Other sources

IBM App Connect Enterprise could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.

— IBM

Affected Software

2 affected componentsFixes available

IBM App Connect Enterprise<=13.0.1.0 - 13.0.8.2

IBM App Connect Enterprise>=13.0.1.0<13.0.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM App Connect Enterprise to a version that resolves this vulnerability.
Fixed in 13.0.9.0Patch IT49835

Event History

Oct 9, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Nov 10, 2026

Data Sourced

via NVD·04:18 PM

Affected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291780

Frequently Asked Questions

Which deployments are affected?

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 are identified as affected.

What must happen for exploitation to succeed?

The attack requires user interaction. The attacker would need to use the missing anti-clickjacking controls to induce a user to perform unauthorized actions.

Does exploitation require prior authentication or local access?

The supplied vector indicates no privileges are required and the attack can be performed remotely. It also indicates high attack complexity.

CVE-2026-18194: IBM App Connect Enterprise is vulnerable to a clickjacking attack

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What must happen for exploitation to succeed?

Does exploitation require prior authentication or local access?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must happen for exploitation to succeed?

Does exploitation require prior authentication or local access?