CVE-2026-17428
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, potentially allowing access to information belonging to others.
Risk Assessment
An attacker may access information belonging to other users or organizations, breaching confidentiality. The flaw may lead to leakage of business data.
Recommendation
Update IBM API Connect to a version with the URL-based authorization fix. Implement URL parameter validation and monitor for anomalous requests.
Other vulnerabilities in IBM API Connect
See all- CVE-2017-1322High
IBM API Connect version 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2017-1379High
IBM API Connect version 5.0.0.0 could allow a remote attacker to obtain sensitive information due to improper handling of requests to the Developer Portal.
- CVE-2017-1161High
IBM API Connect version 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. An attacker could exploit this vulnerability by crafting a malicious URL.
- CVE-2026-18838Critical
IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not sufficiently verify identity information supplied in requests. A remote attacker could impersonate another user, obtain sensitive information, and modify API configurations.
- CVE-2026-18836Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
- CVE-2026-18535Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralization of wildcard query operators.
- CVE-2026-17410Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly neutralize argument delimiters. A remote authenticated attacker could access and modify other tenants' portal data.
- CVE-2026-17409Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly handle case sensitivity. Access controls are not applied consistently to all request variations, potentially allowing a remote attacker to execute unauthorized administrative operations and obtain sensitive information.
- CVE-2026-17408Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 improperly neutralize special elements in OS commands. A remote attacker could execute arbitrary code.
- CVE-2026-17403Critical
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 use hard-coded credentials. A remote attacker could gain full administrative control.
Original NVD description (English source)
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS