CVE-2026-17392: Multiple Vulnerabilities in IBM API Connect

Q: Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The vulnerability could let that user obtain administrative access to tenants other than their own.

Q: Which IBM API Connect versions are affected?

Affected versions are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

Q: What is the underlying exploitation mechanism?

The issue is LDAP injection in directory queries. Insufficient neutralization of user-supplied input can alter a query and cause access to be granted beyond the authenticated user's tenant.

Published Nov 5, 2026

Updated

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.

Other sources

IBM API Connect could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.

— IBM

Affected Software

1 affected component

IBM API Connect<=V10.0.8.0 - V10.0.8.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 10.0.8.13
Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:34 AM

Data Sourced

via MITRE·04:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295637

Frequently Asked Questions

Who can exploit this issue?

A remote attacker must be authenticated to IBM API Connect. The vulnerability could let that user obtain administrative access to tenants other than their own.

Which IBM API Connect versions are affected?

Affected versions are 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

What is the underlying exploitation mechanism?

The issue is LDAP injection in directory queries. Insufficient neutralization of user-supplied input can alter a query and cause access to be granted beyond the authenticated user's tenant.

CVE-2026-17392: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

Which IBM API Connect versions are affected?

What is the underlying exploitation mechanism?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which IBM API Connect versions are affected?

What is the underlying exploitation mechanism?