Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Published: 2026-11-07
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure via SSRF
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that allows a remote authenticated attacker to fetch arbitrary URLs from internal networks, which can expose sensitive data. The vulnerability is identified as CWE‑918 and can lead to confidential information leakage if the attacker can target protected endpoints.

Affected Systems

The affected products are IBM API Connect 10.0.8.0 through 10.0.8.12 and IBM API Connect 12.1.0.0 through 12.1.1.2. For each major release, the vulnerable releases include 10.0.8.0, 10.0.8.12, 12.1.0.0, and 12.1.1.2. Vendors: IBM.

Risk and Exploitability

The CVSS score of 7.7 indicates high severity. The EPSS score is not available, so the exploitation probability is unknown, but the flaw requires only authenticated access, meaning any user that can log in to the API management console can potentially exploit it. The vulnerability is not currently listed in CISA's KEV catalog, so there are no confirmed exploits, but attackers could manually construct SSRF payloads. The attack path is remote and does not require additional software, so the risk is significant for organizations with exposed IBM API Connect instances.

Generated by OpenCVE AI on November 7, 2026 at 07:14 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade to IBM API Connect v12.1.1.3
  • Upgrade to IBM API Connect 10.0.8.13
  • If immediate upgrade is not possible, disable endpoints that permit external calls, restrict network access to internal resources, and consult IBM support for additional mitigations

Generated by OpenCVE AI on November 7, 2026 at 07:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T01:39:26.501Z

Reserved: 2026-07-25T00:28:40.476Z

Link: CVE-2026-17289

cve-icon Vulnrichment

Updated: 2026-11-08T01:32:04.701Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:35.620

Modified: 2026-11-08T02:17:00.850

Link: CVE-2026-17289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T07:15:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)