Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-17360 (+ 46 other CVEs, listed below) |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-07 |
| Vendor | IBM |
| Product | API Connect |
| CVSS Score | 9.8 (critical); whole set: 9.0–9.9 |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
IBM published two “Multiple Vulnerabilities in IBM API Connect” bulletins — for the V12 branch (12.1.0.0–12.1.1.2) and the V10 branch (10.0.8.0–10.0.8.12). Together they cover more than a hundred CVE IDs; this alert describes 47 vulnerabilities rated CVSS 9.0–9.9. 26 of them affect both branches, the remaining 21 only the 12.1 branch. The headline flaw, CVE-2026-17360 (CVSS 9.8), is hard-coded credentials in API Connect 12.1.0.0–12.1.1.2 that let a remote attacker gain full administrative control; the same flaw type in the 10.0.8 branch is CVE-2026-17403 (CVSS 9.0).
The flaws fall into four groups:
- Remote code execution and injection (16 CVEs) — OS command injection (CVE-2026-17408 without authentication, CVE-2026-17402), code injection (CVE-2026-17359, -17342), path traversal leading to code execution or file writes (including CVE-2026-17340 without authentication), unvalidated content and module uploads (CVE-2026-17399, -17150) and SQL injection (CVE-2026-17134, -17132, -17336, -17396).
- Authentication bypass and hard-coded credentials (10 CVEs) — besides CVE-2026-17360/-17403: improper cryptographic signature verification allowing unauthenticated authentication bypass (CVE-2026-17301), alternate-path bypass with gateway configuration takeover (CVE-2026-17313), obtaining other users’ access tokens (CVE-2026-16720) and account takeover via a sign-in open redirect (CVE-2026-17297).
- SSRF and XXE (10 CVEs) — forcing the server to send requests to internal networks and unintended destinations (including CVE-2026-16918 and CVE-2026-17344 in a service reachable without authentication), XXE (CVE-2026-16884) and file reads via external references in submitted definitions (CVE-2026-17299).
- Tenant isolation and authorization bypass (10 CVEs) — creating, modifying and deleting tenants without authorization (CVE-2026-17362), administrative access to other tenants via LDAP injection (CVE-2026-17392), taking over other organizations (CVE-2026-17292), reading and modifying other tenants’ data and portals (including CVE-2026-17049, -17066, -17410, -17339).
In addition, CVE-2026-18535 (CVSS 9.6) is a ReDoS and unneutralized wildcard query operator issue.
API Connect manages API publishing, the API catalog, the developer portal and gateway configuration — taking over the platform gives an attacker visibility into the company’s integrations, keys and data flowing through the APIs, and in multi-tenant deployments also access to other tenants’ data.
Full CVE list
| CVE | CVSS | Group | Type and impact | Branches |
|---|---|---|---|---|
| CVE-2026-17360 | 9.8 | Authentication | hard-coded credentials — full administrative control | 12.1 only |
| CVE-2026-17403 | 9.0 | Authentication | hard-coded credentials — full administrative control | 10.0.8 + 12.1 |
| CVE-2026-17301 | 9.8 | Authentication | improper signature verification — unauthenticated authentication bypass | 10.0.8 + 12.1 |
| CVE-2026-17313 | 9.8 | Authentication | authentication bypass via alternate path — gateway configuration takeover | 12.1 only |
| CVE-2026-16720 | 9.8 | Authentication | insufficient authentication against directory service — other users’ access tokens | 10.0.8 + 12.1 |
| CVE-2026-17278 | 9.8 | Authentication | trusted-party spoofing — access to API catalog and runtime configuration | 12.1 only |
| CVE-2026-17158 | 9.9 | Authentication | improper authentication — privilege escalation | 10.0.8 + 12.1 |
| CVE-2026-18838 | 9.4 | Authentication | user impersonation — API configuration changes | 12.1 only |
| CVE-2026-17297 | 9.6 | Authentication | sign-in open redirect — account takeover | 10.0.8 + 12.1 |
| CVE-2026-17409 | 9.4 | Authentication | case-sensitivity handling — access control bypass, admin operations | 10.0.8 + 12.1 |
| CVE-2026-17408 | 9.8 | RCE / injection | OS command injection — unauthenticated code execution | 10.0.8 + 12.1 |
| CVE-2026-17340 | 9.8 | RCE / injection | path traversal — unauthenticated code execution | 12.1 only |
| CVE-2026-17402 | 9.9 | RCE / injection | OS command injection — command execution on the host | 10.0.8 + 12.1 |
| CVE-2026-17359 | 9.9 | RCE / injection | code injection (CWE-94) — code execution | 10.0.8 + 12.1 |
| CVE-2026-17342 | 9.9 | RCE / injection | code injection (CWE-94) — code execution | 10.0.8 + 12.1 |
| CVE-2026-17399 | 9.9 | RCE / injection | insufficient upload validation — code execution | 10.0.8 + 12.1 |
| CVE-2026-17150 | 9.9 | RCE / injection | custom module upload — code execution and cross-tenant access | 10.0.8 + 12.1 |
| CVE-2026-17117 | 9.9 | RCE / injection | uncontrolled object attribute modification — code execution | 10.0.8 + 12.1 |
| CVE-2026-17239 | 9.9 | RCE / injection | path traversal — code execution | 12.1 only |
| CVE-2026-17147 | 9.9 | RCE / injection | path traversal — code execution and admin actions | 10.0.8 + 12.1 |
| CVE-2026-17354 | 9.9 | RCE / injection | path traversal — arbitrary file write | 12.1 only |
| CVE-2026-17134 | 9.9 | RCE / injection | SQL injection — arbitrary SQL commands | 12.1 only |
| CVE-2026-17132 | 9.9 | RCE / injection | SQL injection — arbitrary SQL commands | 12.1 only |
| CVE-2026-17336 | 9.9 | RCE / injection | SQL injection — arbitrary SQL commands | 12.1 only |
| CVE-2026-17396 | 9.6 | RCE / injection | SQL injection — information disclosure | 10.0.8 + 12.1 |
| CVE-2026-17146 | 9.9 | RCE / injection | JavaScript execution (CWE-79) — information disclosure | 10.0.8 + 12.1 |
| CVE-2026-16884 | 9.9 | SSRF / XXE | XXE — information disclosure | 12.1 only |
| CVE-2026-17299 | 9.6 | SSRF / XXE | external references in definitions — file read and SSRF | 10.0.8 + 12.1 |
| CVE-2026-17298 | 9.9 | SSRF / XXE | SSRF — information disclosure | 10.0.8 + 12.1 |
| CVE-2026-17296 | 9.6 | SSRF / XXE | SSRF — information disclosure | 10.0.8 + 12.1 |
| CVE-2026-17353 | 9.6 | SSRF / XXE | SSRF — information disclosure, restriction bypass | 12.1 only |
| CVE-2026-16918 | 9.3 | SSRF / XXE | SSRF — access to internal network resources | 10.0.8 + 12.1 |
| CVE-2026-17131 | 9.3 | SSRF / XXE | SSRF — outbound restriction bypass | 12.1 only |
| CVE-2026-17344 | 9.3 | SSRF / XXE | SSRF in a service reachable without authentication | 12.1 only |
| CVE-2026-17329 | 9.3 | SSRF / XXE | improper endpoint URL validation (SSRF) | 12.1 only |
| CVE-2026-18836 | 9.3 | SSRF / XXE | SSRF — information disclosure | 10.0.8 + 12.1 |
| CVE-2026-17362 | 9.8 | Tenant isolation / authorization | missing authorization — create, modify, delete tenants | 12.1 only |
| CVE-2026-17392 | 9.9 | Tenant isolation / authorization | LDAP injection — administrative access to other tenants | 10.0.8 + 12.1 |
| CVE-2026-17410 | 9.9 | Tenant isolation / authorization | argument injection — other tenants’ portal data | 10.0.8 + 12.1 |
| CVE-2026-17049 | 9.9 | Tenant isolation / authorization | authorization bypass via user-controlled keys — read/modify documents | 12.1 only |
| CVE-2026-16920 | 9.9 | Tenant isolation / authorization | confused deputy — security restriction bypass | 12.1 only |
| CVE-2026-17394 | 9.6 | Tenant isolation / authorization | object attribute modification — access setting change | 10.0.8 + 12.1 |
| CVE-2026-17066 | 9.1 | Tenant isolation / authorization | missing authorization — other tenants’ data | 12.1 only |
| CVE-2026-17339 | 9.1 | Tenant isolation / authorization | path traversal — other tenants’ resources | 12.1 only |
| CVE-2026-17292 | 9.1 | Tenant isolation / authorization | BOLA — takeover of other organizations | 10.0.8 + 12.1 |
| CVE-2026-17338 | 9.1 | Tenant isolation / authorization | BOLA — information disclosure | 12.1 only |
| CVE-2026-18535 | 9.6 | Other | ReDoS and unneutralized wildcard query operators | 10.0.8 + 12.1 |
Required Actions
- Upgrade IBM API Connect as described in the IBM bulletins:
- API Connect V10 (10.0.8.0–10.0.8.12) → 10.0.8.13,
- API Connect V12 OnPrem (12.1.0.0–12.1.1.2) → 12.1.1.3. Packages are available from IBM Fix Central (linked from the bulletins). IBM lists no workarounds or mitigations.
- Until you upgrade, restrict access to management interfaces (Cloud Manager, API Manager), the developer portal and gateway administrative APIs to a management network and trusted addresses — several flaws (including CVE-2026-17360, -17301, -17340, -17408) require no authentication.
- After upgrading, review administrator accounts, tenants and organizations for unexpected changes, check logs for unusual administrative logins, and consider rotating keys, secrets and tokens used by API Connect and connected backends.
- Restrict outbound traffic from API Connect components to required destinations — this limits the impact of the SSRF flaws.
Who Is Affected?
The vulnerabilities affect organizations that self-manage IBM API Connect by IBM in versions 10.0.8.0–10.0.8.12 or 12.1.0.0–12.1.1.2 (the V12 bulletin lists the product as “API Connect V12 OnPrem”) — a platform used to publish APIs for partners, customers and mobile apps. Deployments with an internet-facing developer portal or management interfaces and multi-tenant environments (many organizations or tenants on one platform) are most exposed.
Sources
-
IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (V12, 12.1.0.0–12.1.1.2)
-
IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (V10, 10.0.8.0–10.0.8.12)
-
NVD - CVE-2026-17360 (other CVEs — links in the table)
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is CVE-2026-17360 in IBM API Connect?
It is the use of hard-coded credentials (CWE-798) in IBM API Connect 12.1.0.0–12.1.1.2 that lets an unauthenticated remote attacker gain full administrative control (CVSS 9.8). The same flaw type in the 10.0.8 branch is CVE-2026-17403 (CVSS 9.0). Both belong to a set of 47 critical vulnerabilities covered by IBM bulletins of 5 November 2026.
Which IBM API Connect versions fix these vulnerabilities?
According to IBM bulletins: upgrade the V10 branch (10.0.8.0–10.0.8.12) to 10.0.8.13 and the V12 branch (12.1.0.0–12.1.1.2) to 12.1.1.3. IBM lists no workarounds or mitigations.
