CVE-2026-17310: Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
Other sources
IBM API Connect could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 12.1.1.3
Event History
Frequently Asked Questions
Which deployments are identified as affected?
IBM API Connect V12 OnPrem deployments running versions 12.1.0.0 through 12.1.1.2 are identified as affected.
Does exploitation require local access or prior authentication?
The issue is described as exploitable by a remote attacker. The available information does not state that local access or prior authentication is required.
What could an attacker gain through this issue?
A remote attacker could obtain sensitive information because of the use of a hard-coded cryptographic key.