IBM App Connect Enterprise is vulnerable to improper output neutralization that permits a remote attacker to inject arbitrary HTML into the Web User Interface and Administration REST API. This flaw can enable cross‑site scripting, which may allow an attacker to steal session data, deface the application, or phish credentials from legitimate users. The vulnerability does not by itself grant code execution but can be leveraged to compromise confidentiality, integrity, or user authentication. The weakness is identified as CWE‑79.

IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.30 and 13.0.1.0 through 13.0.8.2 are affected. The applicable fix is APAR IT50120, released in Fix Pack 12.0.12.31 or 13.0.9.0.

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, via the exposed Web UI or REST API with no authentication requirements specified in the description. The risk is amplified if the application runs with elevated privileges or is exposed to the public Internet.