Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
Published: 2026-11-07
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Access
Action: Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a flaw in the assignment of security tokens that allows a remote authenticated attacker to bypass configured access controls and modify or view sensitive data. The improper restriction of token assignment elevates the attacker’s privileges, enabling unauthorized manipulation of confidential information.

Affected Systems

IBMs API Connect product line, specifically the 10.0.8.x series up to 10.0.8.12 and the 12.1.x series up to 12.1.1.2, is impacted. IBM recommends all affected deployments be upgraded to version 12.1.1.3, or for 10.0.8.x users, to at least 10.0.8.13.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. EPSS data is not available, so the exact likelihood of exploitation remains unknown, but the vulnerability is not yet listed in the CISA KEV catalog. The issue requires a remote authenticated client to manipulate the token assignment mechanism, after which the attacker can gain elevated privileges and compromise confidentiality and integrity of protected resources.

Generated by OpenCVE AI on November 7, 2026 at 06:06 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 12.1.1.3, which includes the token assignment fix.
  • If your deployment uses IBM API Connect 10.0.8.x, install any release no later than 10.0.8.13 to remediate the vulnerability.
  • Apply any additional IBM patches that address token handling or authentication logic for your deployment environment.

Generated by OpenCVE AI on November 7, 2026 at 06:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-1259
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:31:24.692Z

Reserved: 2026-07-23T02:27:09.118Z

Link: CVE-2026-16716

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:20.733

Modified: 2026-11-07T05:18:20.977

Link: CVE-2026-16716

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T06:15:15Z

Weaknesses
  • CWE-1259

    Improper Restriction of Security Token Assignment