Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
Published: 2026-11-07
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Server‑Side Request Forgery leading to sensitive data disclosure
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that allows an authenticated attacker to supply an arbitrary URL in a request payload, causing the appliance to reach the target address and return the response, thereby exposing sensitive information or interacting with protected internal services that should remain unreachable.

Affected Systems

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2, including the API management appliance and its gateway components.

Risk and Exploitability

The CVSS score is 8.5 and the vulnerability is not listed in the CISA KEV catalogue; EPSS data is not available, so the exploitation probability is unknown. The flaw requires valid authentication, meaning an insider or a compromised user could initiate the attack remotely from any network that can reach the API Connect instance, making it a high‑risk vector until mitigated.

Generated by OpenCVE AI on November 7, 2026 at 07:15 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 as recommended by IBM.
  • Limit network access to the API Connect appliance to trusted IP ranges.
  • Enforce strict validation of user‑supplied URLs to prevent unauthorized requests.

Generated by OpenCVE AI on November 7, 2026 at 07:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:32:38.261Z

Reserved: 2026-07-25T00:23:16.015Z

Link: CVE-2026-17287

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:35.177

Modified: 2026-11-07T05:18:35.357

Link: CVE-2026-17287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T10:30:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)