IBM API Connect: Authentication bypass via improper certificate validation (CVE-2026-17337)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability identified as CVE-2026-17337. The issue stems from improper certificate validation, which results in inconsistent enforcement of security checks. A remote authenticated attacker may leverage this flaw to establish connections to the application without successfully completing the required authentication protocols.

Impact

Successful exploitation allows an authenticated attacker to bypass intended security controls, potentially leading to unauthorized access to API management functions or data handled by the gateway.

Recommendation

• Identify all instances of IBM API Connect within the environment and verify current version numbers.
• Apply security patches provided by IBM as soon as they become available for the affected versions (12.1.0.0-12.1.1.2).
• Review API management gateway logs for anomalous authentication patterns or connections that deviate from expected certificate-based handshake processes.