{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/api-connect-12.1.0.0-12.1.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9,"id":"CVE-2026-17403"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12)","API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of hard-coded credentials. This vulnerability could allow a remote attacker to gain full administrative control. The CVSS v3.1 base score for this vulnerability is 9.0.\u003c/p\u003e\n","date_modified":"2026-11-07T07:51:02Z","date_published":"2026-11-07T07:51:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials-2a126a9b/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that allow a remote attacker to gain full administrative control.","title":"IBM API Connect: Hard-coded credentials remote administrative access (CVE-2026-17403)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-hardcoded-credentials-2a126a9b/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17354"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability. A remote authenticated attacker can exploit this flaw to perform arbitrary file writes.\u003c/p\u003e\n","date_modified":"2026-11-07T07:50:52Z","date_published":"2026-11-07T07:50:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal-40cd63e4/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability that enables a remote authenticated attacker to perform arbitrary file writes.","title":"IBM API Connect: Arbitrary file write via path traversal (CVE-2026-17354)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-path-traversal-40cd63e4/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-17188"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can exploit this flaw by providing malicious references to external resources during the service definition import process. Successful exploitation allows the server to make requests to internal or restricted network resources, potentially leading to information disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated attacker can abuse the API import feature to perform reconnaissance on internal network infrastructure or access unauthorized services that are otherwise unreachable from the internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of IBM API Connect and identify those running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eMonitor API gateway logs for unusual outbound requests originating from the API Connect server, particularly those targeting internal IP ranges or sensitive internal management interfaces.\u003c/li\u003e\n\u003cli\u003eApply the latest vendor security patches provided by IBM for API Connect to remediate CVE-2026-17188.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T06:02:38Z","date_published":"2026-11-07T06:02:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery (SSRF) during the import of service definitions, allowing an authenticated attacker to access unauthorized internal resources.","title":"IBM API Connect: Server-side request forgery (CVE-2026-17188)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-ssrf-40d36208/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17399"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12)","API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17399","remote-code-execution","api-security"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authenticated remote code execution vulnerability identified as CVE-2026-17399. The flaw originates from the application's failure to adequately validate content prior to processing uploaded files. A remote authenticated attacker can leverage this to trigger arbitrary code execution on the underlying server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the IBM API Connect software. This grants the attacker potential control over the application environment and the ability to access or manipulate data managed by the API gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM API Connect in the infrastructure and verify the version numbers against the affected ranges.\u003c/li\u003e\n\u003cli\u003eApply the latest vendor security patches provided by IBM to remediate CVE-2026-17399.\u003c/li\u003e\n\u003cli\u003eRestrict administrative or file-upload access to the IBM API Connect management interfaces to trusted users only to minimize the risk of exploitation by compromised credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:56:07Z","date_published":"2026-11-07T05:56:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-1f38ddf0/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability allowing remote authenticated users to execute arbitrary code via insufficient validation of uploaded content.","title":"IBM API Connect: Remote authenticated code execution (CVE-2026-17399)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-1f38ddf0/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-17066"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17066 identifies a critical broken access control vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to bypass authorization checks within a multi-tenant environment. Successful exploitation grants the attacker the ability to view, modify, or delete sensitive information belonging to other tenants. No patch availability is specified in the NVD notice; administrators should monitor vendor security portals for immediate updates.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized information disclosure, data manipulation, and data destruction across tenant boundaries. This represents a complete compromise of tenant isolation for affected installations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all IBM API Connect deployments to identify instances running versions 12.1.0.0 through 12.1.1.2.\u003c/li\u003e\n\u003cli\u003eRestrict administrative and tenant-level access to the API Connect management console until a vendor-supplied patch is applied.\u003c/li\u003e\n\u003cli\u003eAudit tenant activity logs for anomalous cross-tenant data access patterns or unauthorized modification attempts.\u003c/li\u003e\n\u003cli\u003eReview vendor-provided security bulletins for the release of fixed versions of IBM API Connect.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:01Z","date_published":"2026-11-07T05:50:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a broken access control vulnerability that allows a remote authenticated attacker to access, modify, or delete data across tenants.","title":"IBM API Connect: Insecure tenant authorization (CVE-2026-17066)","url":"https://feed.craftedsignal.io/briefs/2026-11-07-ibm-api-connect-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - API Connect (12.1.0.0-12.1.1.2)","version":"https://jsonfeed.org/version/1.1"}