Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
Published: 2026-11-07
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Patch Now
AI Analysis

Impact

IBM API Connect versions 10.0.8.0 through 12.1.1.2 contain a SQL injection flaw that allows a remote authenticated attacker to inject arbitrary SQL commands via unescaped sign‑in input. This vulnerability can lead to data exfiltration, unauthorized data modification, or compromise of database integrity and confidentiality.

Affected Systems

The affected products are IBM API Connect for versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2, as identified by the provided CPE entries. IBM recommends upgrading the 10.x line to 10.0.8.13 and the 12.x line to 12.1.1.3 to remediate the issue.

Risk and Exploitability

The CVSS score of 8.5 classifies this issue as high severity. No EPSS score is available, so the current exploitation probability is uncertain. The vulnerability is not listed in CISA KEV. Attackers must be authenticated but can exploit the flaw remotely by submitting malicious input during sign‑in, as described in the advisory.

Generated by OpenCVE AI on November 7, 2026 at 07:49 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205 IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13Fix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all

OpenCVE Recommended Actions

  • Upgrade IBM API Connect to version 10.0.8.13 for the 10.x series or to 12.1.1.3 for the 12.x series using the IBM Fix Central portal.
  • Apply all related security updates according to IBM’s documented procedure for the specific release, ensuring the SQL injection fix is included.
  • After applying the patch, re‑evaluate authentication controls and restrict API Connect access to trusted networks and users to reduce the attack surface while the environment is updated.

Generated by OpenCVE AI on November 7, 2026 at 07:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
Title Multiple Vulnerabilities in IBM API Connect
First Time appeared Ibm
Ibm api Connect
Weaknesses CWE-89
CPEs cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm api Connect
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Api Connect
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-07T04:34:31.881Z

Reserved: 2026-07-25T05:09:57.374Z

Link: CVE-2026-17407

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-07T05:18:57.670

Modified: 2026-11-07T05:18:57.860

Link: CVE-2026-17407

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T08:15:02Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')