{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/api-connect-10.0.8.0-through-10.0.8.12-and-12.1.0.0-through-12.1.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17146"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability (CVE-2026-17146) caused by improper input validation. This flaw could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.\u003c/p\u003e\n","date_modified":"2026-11-07T09:57:43Z","date_published":"2026-11-07T09:57:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a flaw caused by improper input validation, allowing a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information.","title":"IBM API Connect: Arbitrary JavaScript execution and information disclosure (CVE-2026-17146)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b607459c/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17294"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.\u003c/p\u003e\n","date_modified":"2026-11-07T06:07:01Z","date_published":"2026-11-07T06:07:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17294)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-8a0cb215/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17290"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability related to the processing of identity information from external login providers. The system fails to fully verify the cryptographic signatures of incoming identity assertions, which permits an attacker to provide forged identity data to the application. Successful exploitation allows a remote authenticated attacker to create unauthorized user accounts within the environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can bypass identity provider validation logic to create arbitrary user accounts, potentially leading to unauthorized system access or privilege escalation within the context of the API Connect platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all deployed IBM API Connect instances to identify those running vulnerable version ranges (10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eConsult the IBM product security portal for specific patches or configuration updates addressing CVE-2026-17290.\u003c/li\u003e\n\u003cli\u003eReview administrative logs for suspicious user account creation events, specifically those originating from external authentication provider integrations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:06:26Z","date_published":"2026-11-07T06:06:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow a remote authenticated attacker to create unauthorized user accounts by forging identity provider data due to insufficient cryptographic signature verification.","title":"IBM API Connect: Unauthorized account creation vulnerability (CVE-2026-17290)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-vulnerability-d51e014b/"}],"language":"en","title":"CraftedSignal Threat Feed - API Connect (10.0.8.0 Through 10.0.8.12 and 12.1.0.0 Through 12.1.1.2)","version":"https://jsonfeed.org/version/1.1"}