{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmapi_connect/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17338"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. This vulnerability has a CVSS v3.1 base score of 9.1.\u003c/p\u003e\n","date_modified":"2026-11-07T09:57:53Z","date_published":"2026-11-07T09:57:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-65f79a78/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Broken Object-Level Authorization (CVE-2026-17338)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-65f79a78/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17146"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17146) caused by improper input validation. This flaw could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T09:57:43Z","date_published":"2026-11-07T09:57:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a flaw caused by improper input validation, allowing a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.","title":"IBM API Connect: Arbitrary JavaScript execution and information disclosure (CVE-2026-17146)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17134"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. The vulnerability has a CVSS v3.1 base score of 9.9.\u003c/p\u003e\n","date_modified":"2026-11-07T09:57:33Z","date_published":"2026-11-07T09:57:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-6310ded5/","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.","title":"IBM API Connect: SQL Injection (CVE-2026-17134)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-6310ded5/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17289"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). This flaw allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 7.7.\u003c/p\u003e\n","date_modified":"2026-11-07T07:52:26Z","date_published":"2026-11-07T07:52:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8e591fc7/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17289)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8e591fc7/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17287"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. Due to insufficient validation of user-supplied addresses, an authenticated remote attacker can cause the server to send requests to unintended destinations and return the results, potentially leading to the disclosure of sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T07:52:15Z","date_published":"2026-11-07T07:52:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-2f65d992/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), allowing a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17287)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-2f65d992/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17279"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","api-security","cloud"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that permits an authenticated remote attacker to perform a denial of service attack. By sending specially crafted requests, an attacker can trigger uncontrolled resource consumption within the system, resulting in stalled internal processing and service unavailability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability, preventing legitimate users from accessing API Connect services. The vulnerability carries a CVSS v3.1 base score of 7.7.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eInventory all instances of IBM API Connect within the environment and verify version numbers against the affected ranges. Monitor vendor security updates and apply patches as they become available to remediate CVE-2026-17279.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:49Z","date_published":"2026-11-07T07:51:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-dos/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a remote authenticated denial of service attack caused by uncontrolled resource consumption.","title":"IBM API Connect: Denial of Service via uncontrolled resource consumption (CVE-2026-17279)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17187"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. The vulnerability has a CVSS v3.1 base score of 8.5.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:38Z","date_published":"2026-11-07T07:51:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-7c251cd7/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving improper validation of user-supplied URLs that allows a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Sensitive information disclosure via URL validation (CVE-2026-17187)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-7c251cd7/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-18836"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:19Z","date_published":"2026-11-07T07:51:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e4f76158/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), which may allow a remote attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-18836)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e4f76158/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9,"id":"CVE-2026-17403"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12)","API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of hard-coded credentials. This vulnerability could allow a remote attacker to gain full administrative control. The CVSS v3.1 base score for this vulnerability is 9.0.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:02Z","date_published":"2026-11-07T07:51:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials-2a126a9b/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that allow a remote attacker to gain full administrative control.","title":"IBM API Connect: Hard-coded credentials remote administrative access (CVE-2026-17403)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials-2a126a9b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17354"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability. A remote authenticated attacker can exploit this flaw to perform arbitrary file writes.\u003c/p\u003e\n","date_modified":"2026-11-07T07:50:52Z","date_published":"2026-11-07T07:50:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal-40cd63e4/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that enables a remote authenticated attacker to perform arbitrary file writes.","title":"IBM API Connect: Arbitrary file write via path traversal (CVE-2026-17354)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal-40cd63e4/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17298"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a Server-Side Request Forgery vulnerability. This vulnerability could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3.1 base score for this vulnerability is 9.9.\u003c/p\u003e\n","date_modified":"2026-11-07T07:50:30Z","date_published":"2026-11-07T07:50:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-9d8a8ff7/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-Side Request Forgery vulnerability (CVE-2026-17298)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-9d8a8ff7/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-17131"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to bypass restrictions on outbound requests, enabling the server to contact unintended destinations and return the response to the attacker.\u003c/p\u003e\n","date_modified":"2026-11-07T07:50:05Z","date_published":"2026-11-07T07:50:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-219850f9/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that may allow a remote attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17131)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-219850f9/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-17319"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 - 12.1.1.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an improper authorization vulnerability (CVE-2026-17319). By relying on client-supplied information to manage authorization, the application permits authenticated remote attackers to perform unauthorized configuration changes that result in service disruption.\u003c/p\u003e\n","date_modified":"2026-11-07T06:08:11Z","date_published":"2026-11-07T06:08:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-authorization-flaw/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability. The application relies on client-supplied information to enforce authorization decisions, allowing a remote authenticated attacker to modify tool configurations and cause a denial of service.","title":"IBM API Connect: Improper authorization flaw (CVE-2026-17319)","url":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-authorization-flaw/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17318"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12)","API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an improper authorization vulnerability (CVE-2026-17318). This issue may allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 7.7.\u003c/p\u003e\n","date_modified":"2026-11-07T06:07:59Z","date_published":"2026-11-07T06:07:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-714ce6e5/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authorization vulnerability that could allow a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Improper authorization information disclosure (CVE-2026-17318)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-714ce6e5/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-17311"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken object-level authorization vulnerability, identified as CVE-2026-17311. This flaw allows a remote authenticated attacker to modify application API subscriptions.\u003c/p\u003e\n","date_modified":"2026-11-07T06:07:39Z","date_published":"2026-11-07T06:07:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-840f7577/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows a remote authenticated attacker to modify application API subscriptions.","title":"IBM API Connect: Broken object-level authorization (CVE-2026-17311)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-840f7577/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17295"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by a path traversal vulnerability (CVE-2026-17295). This vulnerability could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3.1 base score for this vulnerability is 7.7.\u003c/p\u003e\n","date_modified":"2026-11-07T06:07:11Z","date_published":"2026-11-07T06:07:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal-f6d329a3/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Path traversal information disclosure (CVE-2026-17295)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal-f6d329a3/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17294"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.\u003c/p\u003e\n","date_modified":"2026-11-07T06:07:01Z","date_published":"2026-11-07T06:07:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17294)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-17291"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"","date_modified":"2026-11-07T06:06:34Z","date_published":"2026-11-07T06:06:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect-80639435/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability during OAuth 2.0 sign-in, which may allow a remote authenticated attacker to have authentication results sent to an attacker-controlled location, potentially leading to account takeover.","title":"IBM API Connect: Account takeover via OAuth 2.0 open redirect (CVE-2026-17291)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect-80639435/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17290"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability related to the processing of identity information from external login providers. The system fails to fully verify the cryptographic signatures of incoming identity assertions, which permits an attacker to provide forged identity data to the application. Successful exploitation allows a remote authenticated attacker to create unauthorized user accounts within the environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can bypass identity provider validation logic to create arbitrary user accounts, potentially leading to unauthorized system access or privilege escalation within the context of the API Connect platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployed IBM API Connect instances to identify those running vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eConsult the IBM product security portal for specific patches or configuration updates addressing CVE-2026-17290.\u003c/li\u003e\n\u003cli\u003eReview administrative logs for suspicious user account creation events, specifically those originating from external authentication provider integrations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:06:26Z","date_published":"2026-11-07T06:06:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to create unauthorized user accounts by forging identity provider data due to insufficient cryptographic signature verification.","title":"IBM API Connect: Unauthorized account creation vulnerability (CVE-2026-17290)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17288"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["IBM API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to server-side request forgery (SSRF). This vulnerability may allow a remote authenticated attacker to obtain sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T06:06:10Z","date_published":"2026-11-07T06:06:10Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-7c61d43d/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17288)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-7c61d43d/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17285"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17285) that permits an authenticated remote attacker to obtain sensitive information. The flaw stems from improper validation of external references when the application processes schemas, allowing the server to fetch content from unauthorized external resources.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to access and retrieve sensitive information from external resources that the server should not have permission to reach.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory instances of IBM API Connect within your environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.\u003c/li\u003e\n\u003cli\u003eReview vendor security bulletins for the release of patches addressing CVE-2026-17285 and schedule upgrades immediately upon availability.\u003c/li\u003e\n\u003cli\u003eReview API gateway configuration logs for abnormal outbound requests originating from the API Connect server towards internal or external unauthorized endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:05:55Z","date_published":"2026-11-07T06:05:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln-7c0eb674/","summary":"IBM API Connect contains a vulnerability that allows a remote authenticated attacker to perform unauthorized data retrieval through improper validation of external references during schema validation.","title":"IBM API Connect: Information disclosure via external references (CVE-2026-17285)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln-7c0eb674/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-17284"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper validation of client-supplied information and insufficient verification of tenant context could allow a remote authenticated attacker to perform unauthorized operations on resources belonging to other tenants.\u003c/p\u003e\n","date_modified":"2026-11-07T06:05:45Z","date_published":"2026-11-07T06:05:45Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information and insufficient verification of tenant context.","title":"IBM API Connect: Cross-tenant unauthorized operations (CVE-2026-17284)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17281"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to obtain sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T06:05:22Z","date_published":"2026-11-07T06:05:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-a7612077/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17281)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-a7612077/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17228"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 - 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This flaw allows a remote authenticated attacker to bypass destination restrictions on outbound requests, potentially enabling the retrieval of content from unintended resources.\u003c/p\u003e\n","date_modified":"2026-11-07T06:04:52Z","date_published":"2026-11-07T06:04:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-6def7b9c/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to bypass destination restrictions and retrieve content from unintended resources.","title":"IBM API Connect: Server-side request forgery vulnerability (CVE-2026-17228)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-6def7b9c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-17190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a cross-site scripting vulnerability identified as CVE-2026-17190. The vulnerability exists because HTML content supplied by a provider is not sufficiently sanitized before display, which could allow script content to run in the user's browser.\u003c/p\u003e\n\u003ch2 id=\"technical-details\"\u003eTechnical Details\u003c/h2\u003e\n\u003cp\u003eA remote authenticated attacker can leverage this vulnerability to execute arbitrary JavaScript.\u003c/p\u003e\n","date_modified":"2026-11-07T06:02:51Z","date_published":"2026-11-07T06:02:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss-d83cb1cf/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting vulnerability (CVE-2026-17190) that allows a remote authenticated attacker to execute arbitrary JavaScript due to insufficient sanitization of HTML content supplied by a provider.","title":"IBM API Connect: Cross-site scripting vulnerability (CVE-2026-17190)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss-d83cb1cf/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17172"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect (versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2) is vulnerable to an improper authentication flaw. This allows a remote authenticated attacker to bypass security restrictions by impersonating another party, as the system does not sufficiently verify information supplied by the client.\u003c/p\u003e\n","date_modified":"2026-11-07T06:02:20Z","date_published":"2026-11-07T06:02:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-88467191/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability. A remote authenticated attacker may impersonate another party due to insufficient verification of client-supplied information.","title":"IBM API Connect: Security restriction bypass (CVE-2026-17172)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-88467191/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-17129"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. A remote authenticated attacker can exploit this to obtain sensitive information and cause a denial of service.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized disclosure of sensitive information and denial of service.\u003c/p\u003e\n","date_modified":"2026-11-07T06:02:10Z","date_published":"2026-11-07T06:02:10Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference vulnerability that allows remote authenticated attackers to obtain sensitive information and cause a denial of service.","title":"IBM API Connect: Insecure direct object reference (CVE-2026-17129)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-16717"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.\u003c/p\u003e\n","date_modified":"2026-11-07T06:00:55Z","date_published":"2026-11-07T06:00:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-ca26976c/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to broken object-level authorization, which may allow a remote authenticated attacker to obtain sensitive information.","title":"IBM API Connect: Broken Object-Level Authorization (CVE-2026-16717)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-ca26976c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-16715"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to retrieve sensitive information belonging to other tenants in a multi-tenant environment. This issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized cross-tenant data access, potentially exposing sensitive API configuration or data protected by the gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and inventory all IBM API Connect instances within the environment.\u003c/li\u003e\n\u003cli\u003eReview vendor security bulletins for IBM API Connect to identify the specific patch or upgrade path for the affected 10.x and 12.x versions.\u003c/li\u003e\n\u003cli\u003eApply security updates immediately once released by IBM.\u003c/li\u003e\n\u003cli\u003eAudit API access logs to identify suspicious patterns of unauthorized object access (e.g., a single authenticated user accessing multiple distinct tenant IDs).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:00:31Z","date_published":"2026-11-07T06:00:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows authenticated attackers to access data from other tenants.","title":"IBM API Connect: Broken Object Level Authorization (CVE-2026-16715)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-16714"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains a path traversal vulnerability in specific versions (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2). This flaw allows a remote attacker to overwrite arbitrary files on the underlying file system. No exploit path or proof-of-concept is currently documented by the source.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all internet-facing instances of IBM API Connect to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.\u003c/li\u003e\n\u003cli\u003eReview official vendor security advisories from IBM for patch availability and apply the corresponding update to the affected API Connect components.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous directory traversal patterns, such as sequences including '../', '%2e%2e/', or equivalent encoding, targeted at API management endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:00:16Z","date_published":"2026-11-07T06:00:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-api-connect-traversal/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to overwrite arbitrary files on the system.","title":"IBM API Connect: Arbitrary file overwrite vulnerability (CVE-2026-16714)","url":"https://feed.craftedsignal.io/briefs/2026-11-api-connect-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-16709"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a cross-site scripting vulnerability. User-supplied input is not properly neutralized when a web page is updated, allowing a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser.\u003c/p\u003e\n","date_modified":"2026-11-07T05:59:55Z","date_published":"2026-11-07T05:59:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting.","title":"IBM API Connect: Cross-site scripting (CVE-2026-16709)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105002"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow arbitrary code to be executed by the management service in certain non-default configurations. This is caused by improper control of generation of code, where customization content may be evaluated as code. This vulnerability is only possible where the related feature is enabled and not properly restricted.\u003c/p\u003e\n","date_modified":"2026-11-07T05:59:34Z","date_published":"2026-11-07T05:59:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b3c95351/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow arbitrary code execution in the management service due to improper control of generation of code.","title":"IBM API Connect: Arbitrary code execution (CVE-2026-105002)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b3c95351/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-18838"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability due to improper authentication. Identity information provided in requests is not sufficiently verified, allowing remote attackers to impersonate other users. This can lead to the unauthorized disclosure of sensitive information and the modification of API configurations.\u003c/p\u003e\n","date_modified":"2026-11-07T05:56:57Z","date_published":"2026-11-07T05:56:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-98f35000/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability that allows a remote attacker to obtain sensitive information and modify API configurations.","title":"IBM API Connect: Improper authentication vulnerability (CVE-2026-18838)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-98f35000/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-17409"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability (CVE-2026-17409) that may allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information. The issue arises from improper handling of case sensitivity, which causes access controls to be applied inconsistently to variations of a request.\u003c/p\u003e\n","date_modified":"2026-11-07T05:56:36Z","date_published":"2026-11-07T05:56:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-cve-2026-17409/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper handling of case sensitivity leads to inconsistent application of access controls.","title":"IBM API Connect: Unauthorized administrative access due to case sensitivity handling (CVE-2026-17409)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-cve-2026-17409/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17402"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12)","API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to OS command injection. This issue occurs because user-supplied input is not properly neutralized before being passed to the underlying operating system, which could allow commands to run on the host.\u003c/p\u003e\n","date_modified":"2026-11-07T05:56:14Z","date_published":"2026-11-07T05:56:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-dd61e43a/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands.","title":"IBM API Connect: Remote command execution (CVE-2026-17402)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-dd61e43a/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17399"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12)","API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17399","remote-code-execution","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authenticated remote code execution vulnerability identified as CVE-2026-17399. The flaw originates from the application's failure to adequately validate content prior to processing uploaded files. A remote authenticated attacker can leverage this to trigger arbitrary code execution on the underlying server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the IBM API Connect software. This grants the attacker potential control over the application environment and the ability to access or manipulate data managed by the API gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM API Connect in the infrastructure and verify the version numbers against the affected ranges.\u003c/li\u003e\n\u003cli\u003eApply the latest vendor security patches provided by IBM to remediate CVE-2026-17399.\u003c/li\u003e\n\u003cli\u003eRestrict administrative or file-upload access to the IBM API Connect management interfaces to trusted users only to minimize the risk of exploitation by compromised credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:56:07Z","date_published":"2026-11-07T05:56:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-1f38ddf0/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability allowing remote authenticated users to execute arbitrary code via insufficient validation of uploaded content.","title":"IBM API Connect: Remote authenticated code execution (CVE-2026-17399)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-1f38ddf0/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17392"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains an LDAP injection vulnerability due to improper neutralization of user-supplied input in directory queries. An authenticated remote attacker can exploit this flaw to manipulate the logic of LDAP queries, potentially leading to unauthorized administrative access to other tenants within the environment. As of the current disclosure, IBM has released advisory information; administrators should verify their current version against the affected ranges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an authenticated attacker to bypass standard authorization controls, resulting in unauthorized administrative access to tenants other than their own. The vulnerability is rated with a CVSS v3.1 base score of 9.9.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM API Connect within the environment and verify current versioning.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for the availability of patches addressing CVE-2026-17392.\u003c/li\u003e\n\u003cli\u003eMonitor API Connect access logs for anomalous administrative behavior or high-frequency directory queries originating from standard user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:55:48Z","date_published":"2026-11-07T05:55:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ldap-injection/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an LDAP injection vulnerability that allows authenticated attackers to perform cross-tenant unauthorized administrative access.","title":"IBM API Connect: Unauthorized tenant access via LDAP injection (CVE-2026-17392)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ldap-injection/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17360"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by a vulnerability involving the use of hard-coded credentials. This could allow a remote attacker to gain full administrative control.\u003c/p\u003e\n","date_modified":"2026-11-07T05:55:35Z","date_published":"2026-11-07T05:55:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that could allow a remote attacker to gain full administrative control.","title":"IBM API Connect: Hard-coded credentials remote administrative access (CVE-2026-17360)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17359"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12)","API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17359 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability allows a remote authenticated attacker to execute arbitrary code due to improper control of the generation of code, where a user-supplied value can influence the generated code.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution.\u003c/p\u003e\n","date_modified":"2026-11-07T05:55:25Z","date_published":"2026-11-07T05:55:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-77cf3018/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to remote code execution. A remote authenticated attacker can influence product-generated code via user-supplied values, leading to arbitrary code execution.","title":"IBM API Connect: Remote code execution (CVE-2026-17359)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-77cf3018/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17353"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.\u003c/p\u003e\n","date_modified":"2026-11-07T05:55:09Z","date_published":"2026-11-07T05:55:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-17353/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery, which may allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions.","title":"IBM API Connect: SSRF information disclosure and security bypass (CVE-2026-17353)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-17353/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17340"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 allow a remote attacker to execute arbitrary code due to a path traversal vulnerability. This vulnerability has a CVSS v3.1 Base Score of 9.8.\u003c/p\u003e\n","date_modified":"2026-11-07T05:54:46Z","date_published":"2026-11-07T05:54:46Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-cve-2026-17340/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a path traversal vulnerability that allows a remote attacker to execute arbitrary code.","title":"IBM API Connect: Path traversal remote code execution (CVE-2026-17340)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-cve-2026-17340/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17336"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 contains a vulnerability where improper neutralization of special elements used in an SQL command could allow a remote authenticated attacker to execute arbitrary SQL commands. This vulnerability carries a CVSS v3.1 base score of 9.9.\u003c/p\u003e\n","date_modified":"2026-11-07T05:54:23Z","date_published":"2026-11-07T05:54:23Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to remote SQL injection, allowing authenticated attackers to execute arbitrary SQL commands.","title":"IBM API Connect: Remote SQL Injection (CVE-2026-17336)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-17329"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 12.1.0.0 through 12.1.1.2 contains a vulnerability that could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs. The vulnerability has a CVSS v3.1 base score of 9.3.\u003c/p\u003e\n","date_modified":"2026-11-07T05:54:14Z","date_published":"2026-11-07T05:54:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a remote information disclosure flaw caused by improper validation of endpoint URLs.","title":"IBM API Connect: Sensitive information disclosure (CVE-2026-17329)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17313"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability via an alternate path. This flaw may allow a remote attacker to obtain sensitive information and take control of gateway configuration.\u003c/p\u003e\n","date_modified":"2026-11-07T05:54:03Z","date_published":"2026-11-07T05:54:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-0e2483c6/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass vulnerability that allows a remote attacker to obtain sensitive information and take control of gateway configuration.","title":"IBM API Connect: Authentication bypass via alternate path (CVE-2026-17313)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-0e2483c6/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17297"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. The redirect address used during the sign-in process is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. This vulnerability carries a CVSS v3.1 base score of 9.6.\u003c/p\u003e\n","date_modified":"2026-11-07T05:51:44Z","date_published":"2026-11-07T05:51:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to an open redirect during sign-in, which may allow a remote attacker to perform an account takeover.","title":"IBM API Connect: Open redirect account takeover (CVE-2026-17297)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17296"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. The vulnerability has a CVSS v3.1 Base Score of 9.6.\u003c/p\u003e\n","date_modified":"2026-11-07T05:51:35Z","date_published":"2026-11-07T05:51:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e6ab3907/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17296)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e6ab3907/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17292"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17292","bola","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains a broken object-level authorization (BOLA) vulnerability (CVE-2026-17292) caused by incomplete access checks on organization objects. A remote authenticated attacker can leverage this flaw to modify the ownership of organizations they do not control, leading to unauthorized privilege escalation and takeover of organizational resources.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to gain full administrative control over target organizations, potentially resulting in unauthorized access to sensitive API data, configuration modifications, and full resource takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003ePrioritize the application of vendor-supplied security patches or version upgrades as documented in official IBM security bulletins for CVE-2026-17292.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for administrative configuration changes within API Connect to detect anomalous organization ownership transfers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:51:27Z","date_published":"2026-11-07T05:51:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-brola/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization vulnerability allowing remote authenticated attackers to seize ownership of unauthorized organizations.","title":"IBM API Connect: Broken object-level authorization (CVE-2026-17292)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-brola/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17278"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by a vulnerability (CVE-2026-17278) due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a remote attacker to appear as a trusted party and gain unauthorized access to sensitive API catalog and runtime configuration data.\u003c/p\u003e\n","date_modified":"2026-11-07T05:51:18Z","date_published":"2026-11-07T05:51:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-074a2eb3/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability that allows a remote attacker to impersonate a trusted party and access sensitive API catalog and runtime configuration data.","title":"IBM API Connect: Unauthorized access via improper authentication (CVE-2026-17278)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-074a2eb3/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17117"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17117","rce","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17117 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows an authenticated remote user to manipulate object attributes that are intended to be restricted to system use. Successful exploitation enables the execution of arbitrary code within the context of the affected application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution by authenticated users, potentially leading to full system compromise of the API Connect instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory IBM API Connect instances to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for the release of fixed firmware or software updates and prioritize patching of internet-facing instances.\u003c/li\u003e\n\u003cli\u003eMonitor authentication logs for suspicious administrative activity or unauthorized API call patterns targeting object configuration endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:12Z","date_published":"2026-11-07T05:50:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce/","summary":"An improper control of object attributes in IBM API Connect allows a remote authenticated attacker to modify system-reserved fields, leading to arbitrary code execution.","title":"IBM API Connect: Remote code execution via object attribute modification (CVE-2026-17117)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-16920"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a confused deputy vulnerability that allows a remote authenticated attacker to bypass security restrictions. This vulnerability has been assigned a CVSS v3.1 base score of 9.9.\u003c/p\u003e\n","date_modified":"2026-11-07T05:49:46Z","date_published":"2026-11-07T05:49:46Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bypass/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to a confused deputy flaw that allows a remote authenticated attacker to bypass security restrictions.","title":"IBM API Connect: Security restriction bypass (CVE-2026-16920)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-16918"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This vulnerability could allow a remote attacker to access internal network resources. The vulnerability is assigned a CVSS v3.1 base score of 9.3.\u003c/p\u003e\n","date_modified":"2026-11-07T05:49:38Z","date_published":"2026-11-07T05:49:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery vulnerability that could allow a remote attacker to access internal network resources.","title":"IBM API Connect: Server-side request forgery (CVE-2026-16918)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-16884"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an XML external entity (XXE) injection. This vulnerability could allow a remote attacker to obtain sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T05:49:28Z","date_published":"2026-11-07T05:49:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xxe/","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.","title":"IBM API Connect: XML External Entity (XXE) injection (CVE-2026-16884)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xxe/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-16720"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12)","API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability. Authentication against a connected directory service is not sufficiently enforced, which could allow a remote attacker to assume another user's identity by obtaining valid access tokens. The CVSS v3.1 base score for this vulnerability is 9.8.\u003c/p\u003e\n","date_modified":"2026-11-07T05:49:19Z","date_published":"2026-11-07T05:49:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to improper authentication, which could allow a remote attacker to obtain valid access tokens for other users.","title":"IBM API Connect: Improper authentication vulnerability (CVE-2026-16720)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}