CVE-2026-17405: Multiple Vulnerabilities in IBM API Connect

Q: Who is exposed to this issue?

IBM API Connect deployments running versions 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 are affected. Exploitation requires a remote attacker to be authenticated.

Q: What access does an attacker need to exploit it?

The attacker needs valid authenticated access to IBM API Connect. The flaw involves authorization checks that fail to verify whether that user is permitted to read particular keystore objects.

Q: What information could be exposed?

An authenticated attacker may obtain sensitive information associated with keystore objects. The provided information does not specify the exact keystore data or credential material that may be disclosed.

Published Nov 5, 2026

Updated

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.

Other sources

IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.

— IBM

Affected Software

1 affected component

IBM API Connect<=V10.0.8.0 - V10.0.8.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 10.0.8.13
Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:34 AM

Data Sourced

via MITRE·04:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295637

Frequently Asked Questions

Who is exposed to this issue?

IBM API Connect deployments running versions 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 are affected. Exploitation requires a remote attacker to be authenticated.

What access does an attacker need to exploit it?

The attacker needs valid authenticated access to IBM API Connect. The flaw involves authorization checks that fail to verify whether that user is permitted to read particular keystore objects.

What information could be exposed?

An authenticated attacker may obtain sensitive information associated with keystore objects. The provided information does not specify the exact keystore data or credential material that may be disclosed.

CVE-2026-17405: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

What information could be exposed?