CVE-2026-114468

Description

IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 6.0CVSS 3.1, Mediumfrom the CNA (ibm)CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

What to do

• IBM strongly suggests the following: App Connect Enterprise Certified Container CD and 13 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 13.7.0 or higher, and ensure that all components are at 13.0.9.1-r1 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/13.0?topic=releases-upgrading-operator App Connect Enterprise Certified Container 12.0 LTS (Long Term Support) Upgrade to App Connect Enterprise Certified Container Operator version 12.0.29 or higher, and ensure that all components are at 12.0.12-r29 or higher.  Documentation on the upgrade process is available at https://www.ibm.com/docs/en/app-connect/12.0?topic=umfpr-upgrading-operator-releasesCNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-798

References

• www.ibm.comvendor-advisorypatch