CVE-2026-16712: Multiple Vulnerabilities in IBM API Connect

Q: Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The issue concerns access across tenants, so environments with more than one tenant are the relevant exposure scenario.

Q: What does an attacker need to do to access another tenant's data?

The attacker would need to supply request identifiers that refer to resources belonging to another tenant. The affected authorization checks do not sufficiently validate those identifiers against the authenticated user's permissions.

Q: Which versions are identified as affected?

The affected ranges are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Published Nov 5, 2026

Updated

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.

Other sources

IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.

— IBM

Affected Software

1 affected component

IBM API Connect<=V10.0.8.0 - V10.0.8.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 10.0.8.13
Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:31 AM

Data Sourced

via MITRE·04:31 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295637

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The issue concerns access across tenants, so environments with more than one tenant are the relevant exposure scenario.

What does an attacker need to do to access another tenant's data?

The attacker would need to supply request identifiers that refer to resources belonging to another tenant. The affected authorization checks do not sufficiently validate those identifiers against the authenticated user's permissions.

Which versions are identified as affected?

The affected ranges are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

CVE-2026-16712: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access another tenant's data?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to access another tenant's data?

Which versions are identified as affected?