Medium severity · published Mar 3, 2026
CVE-2025-13490
IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Connect Enterprise Certified Containers Operands versions CD 12.0.11.2‑r1 through 12.0.12.5‑r1 and 13.0.1.0‑r1 through 13.0.6.1‑r1, and LTS versions 12.0.12‑r1 through 12.0.12‑r20, contain a vulnerability in which the IBM App Connect Enterprise Certified Container transmits data in clear text, potentially allowing an attacker to intercept and obtain sensitive information through man‑in‑the‑middle techniques.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
App Connect EnterpriseCertified Containers Operands · IBM
CD:12.0.11.2 through r1 - 12.0.12.5-r1, 13.0.1.0-r1 - 13.0.6.1-r112.0 LTS:12.0.12-r1 - 12.0.12-r20 · source: vendor
AC
App Connect Operator · IBM
CD:11.3.0 through 11.6.0, 12.1.0 - 12.20.112.0 LTS:12.0.0 - 12.0.20 · source: vendor, NVD
AC
App Connect Enterprise Certified Containers Operands · Ibm
12.0.11.2; 12.0.11.3; 12.0.12; 12.0.12; 12.0.12; 12.0.12; +34 more · source: NVD
Affected product
AC
App Connect EnterpriseCertified Containers Operands
IBM