CVE-2026-17362: Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
Other sources
IBM API Connect could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM API Connectto a version that resolves this vulnerability.Fixed in 12.1.1.3
Event History
Frequently Asked Questions
Which deployments are affected?
IBM API Connect V12 OnPrem deployments running versions 12.1.0.0 through 12.1.1.2 are identified as affected.
What access does an attacker need?
The issue is described as remotely exploitable. The provided information does not state that prior authentication or tenant-level privileges are required.
What could an attacker do if exploitation succeeds?
An attacker could create, modify, or delete tenants because authorization checks are missing.