CVE-2026-17287: Multiple Vulnerabilities in IBM API Connect

Q: Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Q: What access or capability does an attacker need?

The attacker needs an authenticated account and the ability to supply an address that the affected server processes. Insufficient validation of that address can cause the server to request unintended destinations and return the results.

Q: What is the potential impact?

An authenticated remote attacker could obtain sensitive information returned from destinations reached through the server-side request forgery condition.

Published Nov 5, 2026

Updated

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.

Other sources

IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.

— IBM

Affected Software

1 affected component

IBM API Connect<=V10.0.8.0 - V10.0.8.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 10.0.8.13
Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in v12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:32 AM

Data Sourced

via MITRE·04:32 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295637

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The issue affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

What access or capability does an attacker need?

The attacker needs an authenticated account and the ability to supply an address that the affected server processes. Insufficient validation of that address can cause the server to request unintended destinations and return the results.

What is the potential impact?

An authenticated remote attacker could obtain sensitive information returned from destinations reached through the server-side request forgery condition.

CVE-2026-17287: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What access or capability does an attacker need?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access or capability does an attacker need?

What is the potential impact?