API Connect (10.0.8.0 Through 10.0.8.12, 12.1.0.0 Through 12.1.1.2) - CraftedSignal Threat Feed

IBM API Connect: Server-side request forgery (CVE-2026-17287)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:52:15 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. Due to insufficient validation of user-supplied addresses, an authenticated remote attacker can cause the server to send requests to unintended destinations and return the results, potentially leading to the disclosure of sensitive information.

IBM API Connect: Broken object-level authorization (CVE-2026-17283)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:52:07 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a broken object-level authorization (BOLA) flaw. This vulnerability enables a remote authenticated attacker to interact with unauthorized objects and retrieve sensitive information. No exploitation details or patch availability dates beyond the advisory notification are disclosed at this time.

Impact

Successful exploitation allows an authenticated attacker to bypass authorization mechanisms, leading to unauthorized disclosure of sensitive data managed by the API Connect platform.

Recommendation

Inventory all deployed instances of IBM API Connect.
Monitor vendor release channels for the issuance of security patches addressing CVE-2026-17283.
Review API access logs for anomalous patterns where authenticated users request identifiers outside their standard scope or expected resource patterns.

IBM API Connect: Server-Side Request Forgery vulnerability (CVE-2026-17298)

hello@craftedsignal.io — Sat, 07 Nov 2026 07:50:30 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a Server-Side Request Forgery vulnerability. This vulnerability could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3.1 base score for this vulnerability is 9.9.

IBM API Connect: Path traversal information disclosure (CVE-2026-17295)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:07:11 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by a path traversal vulnerability (CVE-2026-17295). This vulnerability could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3.1 base score for this vulnerability is 7.7.

IBM API Connect: Broken Object Level Authorization (CVE-2026-17293)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:06:43 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a Broken Object Level Authorization (BOLA) vulnerability, tracked as CVE-2026-17293. The vulnerability exists because the application fails to perform adequate authorization checks when processing requests to modify user profile information. A remote authenticated attacker can manipulate API calls to target and alter profiles belonging to other users.

Impact

Successful exploitation allows a remote authenticated attacker to modify user profile data without proper authorization.

Recommendation

Audit internal API logs to identify any unauthorized attempts to access or modify user profile objects.
Review IBM security bulletins for official patches or configuration mitigations.
Apply the vendor-provided security updates to IBM API Connect immediately upon availability.

IBM API Connect: Server-side request forgery (CVE-2026-17281)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:05:22 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw could allow a remote authenticated attacker to obtain sensitive information.

IBM API Connect: Security restriction bypass (CVE-2026-17172)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:02:20 +0000

IBM API Connect (versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2) is vulnerable to an improper authentication flaw. This allows a remote authenticated attacker to bypass security restrictions by impersonating another party, as the system does not sufficiently verify information supplied by the client.

IBM API Connect: Broken Object Level Authorization (CVE-2026-16715)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:00:31 +0000

IBM API Connect contains a broken object-level authorization (BOLA) vulnerability. An authenticated attacker can exploit this flaw to retrieve sensitive information belonging to other tenants in a multi-tenant environment. This issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Impact

Successful exploitation allows for unauthorized cross-tenant data access, potentially exposing sensitive API configuration or data protected by the gateway.

Recommendation

Identify and inventory all IBM API Connect instances within the environment.
Review vendor security bulletins for IBM API Connect to identify the specific patch or upgrade path for the affected 10.x and 12.x versions.
Apply security updates immediately once released by IBM.
Audit API access logs to identify suspicious patterns of unauthorized object access (e.g., a single authenticated user accessing multiple distinct tenant IDs).

IBM API Connect: Arbitrary file overwrite vulnerability (CVE-2026-16714)

hello@craftedsignal.io — Sat, 07 Nov 2026 06:00:16 +0000

IBM API Connect contains a path traversal vulnerability in specific versions (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2). This flaw allows a remote attacker to overwrite arbitrary files on the underlying file system. No exploit path or proof-of-concept is currently documented by the source.

Recommendation

Audit all internet-facing instances of IBM API Connect to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.
Review official vendor security advisories from IBM for patch availability and apply the corresponding update to the affected API Connect components.
Monitor web server access logs for anomalous directory traversal patterns, such as sequences including '../', '%2e%2e/', or equivalent encoding, targeted at API management endpoints.

IBM API Connect: Cross-site scripting (CVE-2026-16709)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:59:55 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a cross-site scripting vulnerability. User-supplied input is not properly neutralized when a web page is updated, allowing a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser.

IBM API Connect: Unauthorized administrative access due to case sensitivity handling (CVE-2026-17409)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:56:36 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability (CVE-2026-17409) that may allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information. The issue arises from improper handling of case sensitivity, which causes access controls to be applied inconsistently to variations of a request.

IBM API Connect: Server-side request forgery (CVE-2026-17296)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:51:35 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. The vulnerability has a CVSS v3.1 Base Score of 9.6.

IBM API Connect: Path traversal remote code execution (CVE-2026-17147)

hello@craftedsignal.io — Sat, 07 Nov 2026 05:50:43 +0000

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability (CVE-2026-17147). This flaw enables an authenticated remote attacker to bypass intended file system restrictions, potentially leading to arbitrary code execution and the performance of unauthorized administrative functions within the API Connect environment.

Impact

Authenticated remote attackers can gain unauthorized administrative control over the API management environment and execute arbitrary code on the underlying infrastructure.

Recommendation

Inventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.
Apply the vendor-provided security patches or upgrade to a remediated version of API Connect as specified in official IBM security advisories.
Restrict administrative interface access to known, trusted IP addresses and implement robust multi-factor authentication (MFA) to minimize the impact of compromised administrative credentials.