Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
Published: 2026-11-07
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Patch
AI Analysis

Impact

The flaw is an improper input validation error that can allow a remote authenticated attacker to gain access to sensitive information. This vulnerability is classified as CWE-200 and carries a CVSS score of 4.3, indicating a moderate severity impact on confidentiality.

Affected Systems

IBM API Connect products in the 10.0.8 series from 10.0.8.0 through 10.0.8.12 and the 12.1 series from 12.1.0.0 through 12.1.1.2 are affected. The vendor recommends upgrading to 10.0.8.13 or 12.1.1.3 to remediate the issue.

Risk and Exploitability

The vulnerability can be exploited by an attacker who is authenticated to the system, running remotely, and exploiting input handling errors. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the moderate CVSS score implies a non‑critical but still noteworthy risk when living with an exposed sensitive data surface.

Generated by OpenCVE AI on November 7, 2026 at 07:01 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Apply the IBM plug‑in from Fix Central to upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which addresses the input validation flaw.
  • Verify that all input fields are properly validated and configure strict input sanitization where possible.
  • Restrict privileged access to the API Connect administration interface so that only authorized users can send sensitive data to the system, thereby limiting the potential to exploit authenticated‑only attacks.

Generated by OpenCVE AI on November 7, 2026 at 07:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-200
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:31:59.787Z

Reserved: 2026-07-24T17:23:43.161Z

Link: CVE-2026-17144

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:27.640

Modified: 2026-11-07T05:18:27.800

Link: CVE-2026-17144

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T07:15:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor