{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-17337/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-17337"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (12.1.0.0 - 12.1.1.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","cve-2026-17337","ibm","vulnerability"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to an authentication bypass vulnerability identified as CVE-2026-17337. The issue stems from improper certificate validation, which results in inconsistent enforcement of security checks. A remote authenticated attacker may leverage this flaw to establish connections to the application without successfully completing the required authentication protocols.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to bypass intended security controls, potentially leading to unauthorized access to API management functions or data handled by the gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of IBM API Connect within the environment and verify current version numbers.\u003c/li\u003e\n\u003cli\u003eApply security patches provided by IBM as soon as they become available for the affected versions (12.1.0.0-12.1.1.2).\u003c/li\u003e\n\u003cli\u003eReview API management gateway logs for anomalous authentication patterns or connections that deviate from expected certificate-based handshake processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T02:56:55Z","date_published":"2026-11-08T02:56:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-091f1460/","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass vulnerability due to improper certificate validation, allowing authenticated attackers to establish unauthorized connections.","title":"IBM API Connect: Authentication bypass via improper certificate validation (CVE-2026-17337)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-auth-bypass-091f1460/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-17337","version":"https://jsonfeed.org/version/1.1"}