Product
IBM API Connect: Server-side request forgery (CVE-2026-17287)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF), allowing a remote authenticated attacker to obtain sensitive information.
IBM API Connect: Broken object-level authorization (CVE-2026-17283)
1 TTP 1 CVEA broken object-level authorization vulnerability in IBM API Connect allows remote authenticated attackers to access sensitive information by bypassing authorization controls.
IBM API Connect: Server-Side Request Forgery vulnerability (CVE-2026-17298)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect: Path traversal information disclosure (CVE-2026-17295)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.
IBM API Connect: Broken Object Level Authorization (CVE-2026-17293)
1 TTP 1 CVEIBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a Broken Object Level Authorization flaw allowing remote authenticated attackers to modify arbitrary user profile data.
IBM API Connect: Server-side request forgery (CVE-2026-17281)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information.
IBM API Connect: Security restriction bypass (CVE-2026-17172)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper authentication vulnerability. A remote authenticated attacker may impersonate another party due to insufficient verification of client-supplied information.
IBM API Connect: Broken Object Level Authorization (CVE-2026-16715)
1 TTP 1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization flaw that allows authenticated attackers to access data from other tenants.
IBM API Connect: Arbitrary file overwrite vulnerability (CVE-2026-16714)
1 TTP 1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to overwrite arbitrary files on the system.
IBM API Connect: Cross-site scripting (CVE-2026-16709)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting.
IBM API Connect: Unauthorized administrative access due to case sensitivity handling (CVE-2026-17409)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where improper handling of case sensitivity leads to inconsistent application of access controls.
IBM API Connect: Server-side request forgery (CVE-2026-17296)
1 CVEIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect: Path traversal remote code execution (CVE-2026-17147)
2 TTPs 1 CVEIBM API Connect versions 10.0.8.x and 12.1.x contain a path traversal vulnerability (CVE-2026-17147) that allows an authenticated remote attacker to achieve arbitrary code execution and unauthorized administrative access.