Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
Published: 2026-11-07
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an improper verification of a cryptographic signature that allows an unauthenticated attacker to bypass authentication. The weakness, identified as CWE‑347, can lead to unauthorized access to protected APIs, potentially exposing sensitive data or services. The high CVSS score of 9.8 indicates a critical severity.

Affected Systems

The affected product is IBM:API Connect. Vulnerable releases include IBM API Connect 10.0.8.0 up to 10.0.8.12 and IBM API Connect 12.1.0.0 up to 12.1.1.2. Administrators should verify whether these specific versions are deployed in their environments.

Risk and Exploitability

The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, with an unauthenticated attacker sending requests to the API gateway to exploit the improperly verified cryptographic signature. If exploitation succeeds, the attacker can gain unauthorized access to protected resources. Although no known exploit is documented, the high severity makes immediate action essential.

Generated by OpenCVE AI on November 7, 2026 at 07:10 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Apply the IBM-recommended patch to upgrade to v12.1.1.3 or, alternatively, upgrade to IBM API Connect 10.0.8.13, following the Fix Central links provided by IBM.
  • If an upgrade cannot be performed immediately, restrict or block unauthenticated traffic to the API endpoints by configuring firewall or network security groups to only allow traffic from trusted IP ranges, thereby limiting the attack surface.
  • After applying the patch or implementing temporary controls, audit the signature verification logic and confirm that authentication enforcement operates correctly, ensuring the vulnerability is fully remediated.

Generated by OpenCVE AI on November 7, 2026 at 07:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-347
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:32:52.887Z

Reserved: 2026-07-25T00:59:34.617Z

Link: CVE-2026-17301

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:37.913

Modified: 2026-11-07T05:18:38.057

Link: CVE-2026-17301

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T12:00:15Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature