CVE-2026-16718: Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
Other sources
IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 10.0.8.13 - Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 12.1.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
The affected versions are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.
Does exploitation require authentication or network proximity?
The issue is described as exploitable by a remote authenticated attacker. The provided information does not identify any unauthenticated attack path.
What is the likely impact of successful exploitation?
A successful attacker could obtain sensitive information through improper validation of file paths. The provided information does not specify which files or categories of data may be exposed.