CVE-2026-17139: Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
Other sources
IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 10.0.8.13 - Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 12.1.1.3
Event History
Frequently Asked Questions
Which release lines should be considered affected?
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are identified as affected.
Does exploitation require authentication?
Yes. The issue is described as exploitable by a remote authenticated attacker.
What is the practical impact of successful exploitation?
An attacker can place malicious script content in insufficiently validated URL fields, causing that script to run in another user's browser session.