{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmapi_connect12.1.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17283"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization (BOLA) flaw. This vulnerability enables a remote authenticated attacker to interact with unauthorized objects and retrieve sensitive information. No exploitation details or patch availability dates beyond the advisory notification are disclosed at this time.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to bypass authorization mechanisms, leading to unauthorized disclosure of sensitive data managed by the API Connect platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployed instances of IBM API Connect.\u003c/li\u003e\n\u003cli\u003eMonitor vendor release channels for the issuance of security patches addressing CVE-2026-17283.\u003c/li\u003e\n\u003cli\u003eReview API access logs for anomalous patterns where authenticated users request identifiers outside their standard scope or expected resource patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T07:52:07Z","date_published":"2026-11-07T07:52:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-576fa7e8/","summary":"A broken object-level authorization vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information by bypassing authorization controls.","title":"IBM API Connect: Broken object-level authorization (CVE-2026-17283)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-576fa7e8/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17320"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":["idor","vulnerability","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-17320. This vulnerability allows a remote authenticated attacker to access sensitive information by manipulating direct object references within the application. No patch availability or remediation steps are explicitly detailed in the current NVD advisory.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to bypass authorization controls and retrieve sensitive information, leading to unauthorized data exposure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify systems running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security portals for the release of security patches or configuration guidance to mitigate CVE-2026-17320.\u003c/li\u003e\n\u003cli\u003eAudit API access logs for anomalous patterns where authenticated users request resources outside their typical scope or ID ranges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:08:22Z","date_published":"2026-11-07T06:08:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor-88459b41/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw, allowing a remote authenticated attacker to access sensitive information.","title":"IBM API Connect: Insecure direct object reference (CVE-2026-17320)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-idor-88459b41/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-17293"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":["api-security","broken-object-level-authorization","bola","web-application"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, tracked as CVE-2026-17293. The vulnerability exists because the application fails to perform adequate authorization checks when processing requests to modify user profile information. A remote authenticated attacker can manipulate API calls to target and alter profiles belonging to other users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to modify user profile data without proper authorization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit internal API logs to identify any unauthorized attempts to access or modify user profile objects.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for official patches or configuration mitigations.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided security updates to IBM API Connect immediately upon availability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:06:43Z","date_published":"2026-11-07T06:06:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.","title":"IBM API Connect: Broken Object Level Authorization (CVE-2026-17293)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-c7274648/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17188"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can exploit this flaw by providing malicious references to external resources during the service definition import process. Successful exploitation allows the server to make requests to internal or restricted network resources, potentially leading to information disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated attacker can abuse the API import feature to perform reconnaissance on internal network infrastructure or access unauthorized services that are otherwise unreachable from the internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect and identify those running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eMonitor API gateway logs for unusual outbound requests originating from the API Connect server, particularly those targeting internal IP ranges or sensitive internal management interfaces.\u003c/li\u003e\n\u003cli\u003eApply the latest vendor security patches provided by IBM for API Connect to remediate CVE-2026-17188.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:02:38Z","date_published":"2026-11-07T06:02:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17188)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17112"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to bypass tenant isolation and access sensitive data belonging to other tenants within the multi-tenant API environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to read sensitive information belonging to other tenants, leading to unauthorized data exposure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify and inventory instances of IBM API Connect within the environment. Review vendor security bulletins for available patches for the affected versions (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2) and apply updates immediately.\u003c/p\u003e\n","date_modified":"2026-11-07T06:01:59Z","date_published":"2026-11-07T06:01:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-611f9275/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization (BOLA) vulnerability allowing authenticated attackers to access sensitive data of other tenants.","title":"IBM API Connect: Broken Object-Level Authorization (CVE-2026-17112)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-611f9275/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17396"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. A remote authenticated attacker can exploit this flaw to gain unauthorized access to sensitive information stored within the application database.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized retrieval of sensitive data, posing a critical risk to data confidentiality within the affected API management environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployed instances of IBM API Connect to identify versions within the affected ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eMonitor IBM security bulletins for the release of patches or configuration-based mitigations for CVE-2026-17396.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and parameterized queries for all custom API development performed on the IBM API Connect platform to reduce the surface area for SQL injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:56:01Z","date_published":"2026-11-07T05:56:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-c6654e73/","summary":"A SQL injection vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information, carrying a CVSS base score of 9.6.","title":"IBM API Connect: SQL injection vulnerability (CVE-2026-17396)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-c6654e73/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17339"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["path-traversal","web-application","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability. This flaw allows a remote, authenticated attacker to manipulate API requests to access or delete resources belonging to other tenants within the multi-tenant environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized cross-tenant data access and the potential destruction of sensitive API resources, leading to a loss of data confidentiality and integrity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployments of IBM API Connect to identify instances running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eMonitor vendor channels for the release of security patches or configuration workarounds for CVE-2026-17339.\u003c/li\u003e\n\u003cli\u003eImplement strict request validation and object-level authorization checks at the API gateway layer for all tenant-specific endpoints until updates are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:54:39Z","date_published":"2026-11-07T05:54:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that permits a remote authenticated attacker to perform unauthorized access or deletion of resources belonging to other tenants.","title":"IBM API Connect: Path traversal vulnerability (CVE-2026-17339)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17301"},{"id":"CVE-2026-17362"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)","API Connect (v12.1.0.0 through v12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability. This flaw arises from the improper verification of cryptographic signatures, which an unauthenticated attacker could potentially exploit to bypass security controls and gain unauthorized access to the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to bypass authentication, potentially resulting in unauthorized access to API management functions and sensitive data. The vulnerability is rated with a CVSS v3.1 base score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify systems running the vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eReview IBM security advisories for the release of security patches addressing CVE-2026-17301 and apply the appropriate update immediately upon availability.\u003c/li\u003e\n\u003cli\u003eMonitor API gateway access logs for anomalous authentication patterns or requests targeting sensitive endpoints originating from unauthorized sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:22:04Z","date_published":"2026-11-07T05:52:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-23fef13b/","summary":"IBM API Connect contains a critical authentication bypass vulnerability (CVE-2026-17301) due to improper cryptographic signature verification, allowing unauthenticated attackers to gain unauthorized access.","title":"IBM API Connect: Authentication bypass via improper signature verification (CVE-2026-17301)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-23fef13b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17150"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17150","rce","tenant-isolation","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17150 describes a vulnerability in IBM API Connect resulting from insufficient input validation of uploaded custom modules. An authenticated remote attacker can exploit this flaw to execute arbitrary code within the application environment. Due to the nature of the vulnerability, successful exploitation enables a tenant to bypass security boundaries, potentially accessing sensitive information belonging to other tenants.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the API Connect instance and enables cross-tenant data access, compromising the confidentiality and integrity of all tenants within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all current custom module deployments within the IBM API Connect environment to identify any unauthorized or suspicious modifications.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version of IBM API Connect as released by IBM.\u003c/li\u003e\n\u003cli\u003eReview access logs for API endpoints associated with module uploads and management to identify unauthorized authentication or anomalous administrative activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:54Z","date_published":"2026-11-07T05:50:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.","title":"IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17147"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability (CVE-2026-17147). This flaw enables an authenticated remote attacker to bypass intended file system restrictions, potentially leading to arbitrary code execution and the performance of unauthorized administrative functions within the API Connect environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated remote attackers can gain unauthorized administrative control over the API management environment and execute arbitrary code on the underlying infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided security patches or upgrade to a remediated version of API Connect as specified in official IBM security advisories.\u003c/li\u003e\n\u003cli\u003eRestrict administrative interface access to known, trusted IP addresses and implement robust multi-factor authentication (MFA) to minimize the impact of compromised administrative credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:43Z","date_published":"2026-11-07T05:50:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal/","summary":"IBM API Connect versions 10.0.8.x and 12.1.x contain a path traversal vulnerability (CVE-2026-17147) that allows an authenticated remote attacker to achieve arbitrary code execution and unauthorized administrative access.","title":"IBM API Connect: Path traversal remote code execution (CVE-2026-17147)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17066"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17066 identifies a critical broken access control vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to bypass authorization checks within a multi-tenant environment. Successful exploitation grants the attacker the ability to view, modify, or delete sensitive information belonging to other tenants. No patch availability is specified in the NVD notice; administrators should monitor vendor security portals for immediate updates.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized information disclosure, data manipulation, and data destruction across tenant boundaries. This represents a complete compromise of tenant isolation for affected installations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all IBM API Connect deployments to identify instances running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eRestrict administrative and tenant-level access to the API Connect management console until a vendor-supplied patch is applied.\u003c/li\u003e\n\u003cli\u003eAudit tenant activity logs for anomalous cross-tenant data access patterns or unauthorized modification attempts.\u003c/li\u003e\n\u003cli\u003eReview vendor-provided security bulletins for the release of fixed versions of IBM API Connect.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:01Z","date_published":"2026-11-07T05:50:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.","title":"IBM API Connect: Insecure tenant authorization (CVE-2026-17066)","url":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17049"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a critical authorization bypass vulnerability (CVE-2026-17049). An attacker with existing authenticated access can manipulate user-controlled keys to bypass authorization checks, enabling unauthorized information disclosure and modification of arbitrary documents within the environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to read sensitive data and modify arbitrary documents, potentially leading to full compromise of data integrity and confidentiality within the API Connect environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eApply the latest vendor security patches to remediate CVE-2026-17049 immediately.\u003c/li\u003e\n\u003cli\u003eReview access logs and API audit trails for suspicious patterns of unauthorized document modification or unexpected data retrieval requests associated with authenticated user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:49:54Z","date_published":"2026-11-07T05:49:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-d844761e/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an authorization bypass allowing remote authenticated attackers to access sensitive information and modify arbitrary documents.","title":"IBM API Connect: Authorization bypass (CVE-2026-17049)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-d844761e/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}