Description
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
Published: 2026-11-07
Score: 9.9 Critical
EPSS: n/a
KEV: No
Impact: Authentication bypass / Privilege escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a confused deputy issue that allows a remote authenticated attacker to bypass security restrictions, granting unauthorized access and potential privilege escalation within IBM API Connect. It represents a high-impact flaw as indicated by the CVSS score of 9.9.

Affected Systems

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable.

Risk and Exploitability

The CVSS score of 9.9 indicates a critical risk, while no EPSS score is available so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote authenticated user. The flaw arises from a confused‑deputy authorization logic, allowing a logged‑in attacker to override security restrictions and access resources or perform actions beyond their intended scope. IBM recommends upgrading to v12.1.1.3 immediately to mitigate this risk.

Generated by OpenCVE AI on November 7, 2026 at 08:30 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 12.1.1.3 or later.
  • Review API Connect user roles and remove any permissions that allow authenticated users to bypass security restrictions.
  • Restrict network access to the API Connect management console from trusted IP ranges and enforce strong, unique credentials.

Generated by OpenCVE AI on November 7, 2026 at 08:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-441
CPEs cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:31:35.229Z

Reserved: 2026-07-24T07:00:44.655Z

Link: CVE-2026-16920

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:22.990

Modified: 2026-11-07T05:18:23.130

Link: CVE-2026-16920

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:45:05Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')