CVE-2026-18196: IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection
Published Oct 22, 2026
·Updated
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
Other sources
IBM App Connect Enterprise could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
— IBM
Affected Software
4 affected componentsFixes available
IBM App Connect Enterprise<=13.0.1.0 - 13.0.8.2
IBM App Connect Enterprise<=12.0.1.0 - 12.0.12.30
IBM App Connect Enterprise>=12.0.1.0<12.0.12.31
IBM App Connect Enterprise>=13.0.1.0<13.0.9.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 12.0.12.31 - Upgrade
Upgrade
IBM App Connect Enterpriseto a version that resolves this vulnerability.Fixed in 13.0.9.0
Event History
Oct 22, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Nov 8, 2026
CVE Published
via MITRE·05:53 PM
Data Sourced
via MITRE·05:53 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Nov 10, 2026
Data Sourced
via NVD·04:18 PM
Affected Software