IBM API Connect: SQL injection vulnerability (CVE-2026-17396)
A SQL injection vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information, carrying a CVSS base score of 9.6.
CVE search metadata
CVE search record: CVE-2026-17396. Severity: critical. CVSS: 9.6. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: SQL injection vulnerability (CVE-2026-17396). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-c6654e73/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. A remote authenticated attacker can exploit this flaw to gain unauthorized access to sensitive information stored within the application database.
Impact
Successful exploitation allows for the unauthorized retrieval of sensitive data, posing a critical risk to data confidentiality within the affected API management environments.
Recommendation
- Inventory all deployed instances of IBM API Connect to identify versions within the affected ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).
- Monitor IBM security bulletins for the release of patches or configuration-based mitigations for CVE-2026-17396.
- Implement strict input validation and parameterized queries for all custom API development performed on the IBM API Connect platform to reduce the surface area for SQL injection.
Immediate actions
Inventory IBM API Connect instances and correlate with vulnerable versions identified in CVE-2026-17396
Threat Hunt
Identify authenticated API requests containing SQL syntax patterns or unexpected query parameters
Data: API management access logs, Web server request logs