{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/api-connect-10.0.8.0-10.0.8.12-12.1.0.0-12.1.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17289"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF). This flaw allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS v3.1 base score of 7.7.\u003c/p\u003e\n","date_modified":"2026-11-07T07:52:26Z","date_published":"2026-11-07T07:52:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8e591fc7/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17289)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8e591fc7/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17279"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","api-security","cloud"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that permits an authenticated remote attacker to perform a denial of service attack. By sending specially crafted requests, an attacker can trigger uncontrolled resource consumption within the system, resulting in stalled internal processing and service unavailability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability, preventing legitimate users from accessing API Connect services. The vulnerability carries a CVSS v3.1 base score of 7.7.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eInventory all instances of IBM API Connect within the environment and verify version numbers against the affected ranges. Monitor vendor security updates and apply patches as they become available to remediate CVE-2026-17279.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:49Z","date_published":"2026-11-07T07:51:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-dos/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a remote authenticated denial of service attack caused by uncontrolled resource consumption.","title":"IBM API Connect: Denial of Service via uncontrolled resource consumption (CVE-2026-17279)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-18836"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:19Z","date_published":"2026-11-07T07:51:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e4f76158/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), which may allow a remote attacker to obtain sensitive information.","title":"IBM API Connect: Server-side request forgery (CVE-2026-18836)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-e4f76158/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-17291"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"","date_modified":"2026-11-07T06:06:34Z","date_published":"2026-11-07T06:06:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect-80639435/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability during OAuth 2.0 sign-in, which may allow a remote authenticated attacker to have authentication results sent to an attacker-controlled location, potentially leading to account takeover.","title":"IBM API Connect: Account takeover via OAuth 2.0 open redirect (CVE-2026-17291)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect-80639435/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17285"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17285) that permits an authenticated remote attacker to obtain sensitive information. The flaw stems from improper validation of external references when the application processes schemas, allowing the server to fetch content from unauthorized external resources.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to access and retrieve sensitive information from external resources that the server should not have permission to reach.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory instances of IBM API Connect within your environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.\u003c/li\u003e\n\u003cli\u003eReview vendor security bulletins for the release of patches addressing CVE-2026-17285 and schedule upgrades immediately upon availability.\u003c/li\u003e\n\u003cli\u003eReview API gateway configuration logs for abnormal outbound requests originating from the API Connect server towards internal or external unauthorized endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:05:55Z","date_published":"2026-11-07T06:05:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln-7c0eb674/","summary":"IBM API Connect contains a vulnerability that allows a remote authenticated attacker to perform unauthorized data retrieval through improper validation of external references during schema validation.","title":"IBM API Connect: Information disclosure via external references (CVE-2026-17285)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vuln-7c0eb674/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-17284"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper validation of client-supplied information and insufficient verification of tenant context could allow a remote authenticated attacker to perform unauthorized operations on resources belonging to other tenants.\u003c/p\u003e\n","date_modified":"2026-11-07T06:05:45Z","date_published":"2026-11-07T06:05:45Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information and insufficient verification of tenant context.","title":"IBM API Connect: Cross-tenant unauthorized operations (CVE-2026-17284)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-17190"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a cross-site scripting vulnerability identified as CVE-2026-17190. The vulnerability exists because HTML content supplied by a provider is not sufficiently sanitized before display, which could allow script content to run in the user's browser.\u003c/p\u003e\n\u003ch2 id=\"technical-details\"\u003eTechnical Details\u003c/h2\u003e\n\u003cp\u003eA remote authenticated attacker can leverage this vulnerability to execute arbitrary JavaScript.\u003c/p\u003e\n","date_modified":"2026-11-07T06:02:51Z","date_published":"2026-11-07T06:02:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss-d83cb1cf/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a cross-site scripting vulnerability (CVE-2026-17190) that allows a remote authenticated attacker to execute arbitrary JavaScript due to insufficient sanitization of HTML content supplied by a provider.","title":"IBM API Connect: Cross-site scripting vulnerability (CVE-2026-17190)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-xss-d83cb1cf/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-17112"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to bypass tenant isolation and access sensitive data belonging to other tenants within the multi-tenant API environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to read sensitive information belonging to other tenants, leading to unauthorized data exposure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify and inventory instances of IBM API Connect within the environment. Review vendor security bulletins for available patches for the affected versions (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2) and apply updates immediately.\u003c/p\u003e\n","date_modified":"2026-11-07T06:01:59Z","date_published":"2026-11-07T06:01:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-611f9275/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization (BOLA) vulnerability allowing authenticated attackers to access sensitive data of other tenants.","title":"IBM API Connect: Broken Object-Level Authorization (CVE-2026-17112)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-bola-611f9275/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105002"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow arbitrary code to be executed by the management service in certain non-default configurations. This is caused by improper control of generation of code, where customization content may be evaluated as code. This vulnerability is only possible where the related feature is enabled and not properly restricted.\u003c/p\u003e\n","date_modified":"2026-11-07T05:59:34Z","date_published":"2026-11-07T05:59:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b3c95351/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow arbitrary code execution in the management service due to improper control of generation of code.","title":"IBM API Connect: Arbitrary code execution (CVE-2026-105002)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b3c95351/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17396"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability. A remote authenticated attacker can exploit this flaw to gain unauthorized access to sensitive information stored within the application database.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized retrieval of sensitive data, posing a critical risk to data confidentiality within the affected API management environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployed instances of IBM API Connect to identify versions within the affected ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eMonitor IBM security bulletins for the release of patches or configuration-based mitigations for CVE-2026-17396.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and parameterized queries for all custom API development performed on the IBM API Connect platform to reduce the surface area for SQL injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:56:01Z","date_published":"2026-11-07T05:56:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-c6654e73/","summary":"A SQL injection vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information, carrying a CVSS base score of 9.6.","title":"IBM API Connect: SQL injection vulnerability (CVE-2026-17396)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-sql-injection-c6654e73/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17392"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains an LDAP injection vulnerability due to improper neutralization of user-supplied input in directory queries. An authenticated remote attacker can exploit this flaw to manipulate the logic of LDAP queries, potentially leading to unauthorized administrative access to other tenants within the environment. As of the current disclosure, IBM has released advisory information; administrators should verify their current version against the affected ranges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an authenticated attacker to bypass standard authorization controls, resulting in unauthorized administrative access to tenants other than their own. The vulnerability is rated with a CVSS v3.1 base score of 9.9.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM API Connect within the environment and verify current versioning.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for the availability of patches addressing CVE-2026-17392.\u003c/li\u003e\n\u003cli\u003eMonitor API Connect access logs for anomalous administrative behavior or high-frequency directory queries originating from standard user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:55:48Z","date_published":"2026-11-07T05:55:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ldap-injection/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an LDAP injection vulnerability that allows authenticated attackers to perform cross-tenant unauthorized administrative access.","title":"IBM API Connect: Unauthorized tenant access via LDAP injection (CVE-2026-17392)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ldap-injection/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-17301"},{"id":"CVE-2026-17362"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)","API Connect (v12.1.0.0 through v12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability. This flaw arises from the improper verification of cryptographic signatures, which an unauthenticated attacker could potentially exploit to bypass security controls and gain unauthorized access to the application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to bypass authentication, potentially resulting in unauthorized access to API management functions and sensitive data. The vulnerability is rated with a CVSS v3.1 base score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify systems running the vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eReview IBM security advisories for the release of security patches addressing CVE-2026-17301 and apply the appropriate update immediately upon availability.\u003c/li\u003e\n\u003cli\u003eMonitor API gateway access logs for anomalous authentication patterns or requests targeting sensitive endpoints originating from unauthorized sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:22:04Z","date_published":"2026-11-07T05:52:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-23fef13b/","summary":"IBM API Connect contains a critical authentication bypass vulnerability (CVE-2026-17301) due to improper cryptographic signature verification, allowing unauthenticated attackers to gain unauthorized access.","title":"IBM API Connect: Authentication bypass via improper signature verification (CVE-2026-17301)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-23fef13b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-17297"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. The redirect address used during the sign-in process is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. This vulnerability carries a CVSS v3.1 base score of 9.6.\u003c/p\u003e\n","date_modified":"2026-11-07T05:51:44Z","date_published":"2026-11-07T05:51:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to an open redirect during sign-in, which may allow a remote attacker to perform an account takeover.","title":"IBM API Connect: Open redirect account takeover (CVE-2026-17297)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-redirect/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17292"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17292","bola","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect contains a broken object-level authorization (BOLA) vulnerability (CVE-2026-17292) caused by incomplete access checks on organization objects. A remote authenticated attacker can leverage this flaw to modify the ownership of organizations they do not control, leading to unauthorized privilege escalation and takeover of organizational resources.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to gain full administrative control over target organizations, potentially resulting in unauthorized access to sensitive API data, configuration modifications, and full resource takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003ePrioritize the application of vendor-supplied security patches or version upgrades as documented in official IBM security bulletins for CVE-2026-17292.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for administrative configuration changes within API Connect to detect anomalous organization ownership transfers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:51:27Z","date_published":"2026-11-07T05:51:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-brola/","summary":"IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a broken object-level authorization vulnerability allowing remote authenticated attackers to seize ownership of unauthorized organizations.","title":"IBM API Connect: Broken object-level authorization (CVE-2026-17292)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-brola/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17150"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17150","rce","tenant-isolation","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17150 describes a vulnerability in IBM API Connect resulting from insufficient input validation of uploaded custom modules. An authenticated remote attacker can exploit this flaw to execute arbitrary code within the application environment. Due to the nature of the vulnerability, successful exploitation enables a tenant to bypass security boundaries, potentially accessing sensitive information belonging to other tenants.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the API Connect instance and enables cross-tenant data access, compromising the confidentiality and integrity of all tenants within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all current custom module deployments within the IBM API Connect environment to identify any unauthorized or suspicious modifications.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version of IBM API Connect as released by IBM.\u003c/li\u003e\n\u003cli\u003eReview access logs for API endpoints associated with module uploads and management to identify unauthorized authentication or anomalous administrative activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:54Z","date_published":"2026-11-07T05:50:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.","title":"IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17117"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17117","rce","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17117 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows an authenticated remote user to manipulate object attributes that are intended to be restricted to system use. Successful exploitation enables the execution of arbitrary code within the context of the affected application.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution by authenticated users, potentially leading to full system compromise of the API Connect instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory IBM API Connect instances to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.\u003c/li\u003e\n\u003cli\u003eReview IBM security bulletins for the release of fixed firmware or software updates and prioritize patching of internet-facing instances.\u003c/li\u003e\n\u003cli\u003eMonitor authentication logs for suspicious administrative activity or unauthorized API call patterns targeting object configuration endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:12Z","date_published":"2026-11-07T05:50:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce/","summary":"An improper control of object attributes in IBM API Connect allows a remote authenticated attacker to modify system-reserved fields, leading to arbitrary code execution.","title":"IBM API Connect: Remote code execution via object attribute modification (CVE-2026-17117)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-16918"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability. This vulnerability could allow a remote attacker to access internal network resources. The vulnerability is assigned a CVSS v3.1 base score of 9.3.\u003c/p\u003e\n","date_modified":"2026-11-07T05:49:38Z","date_published":"2026-11-07T05:49:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery vulnerability that could allow a remote attacker to access internal network resources.","title":"IBM API Connect: Server-side request forgery (CVE-2026-16918)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)","version":"https://jsonfeed.org/version/1.1"}