CVE-2026-19122: Multiple Vulnerabilities in IBM API Connect

Q: Which deployments are affected?

IBM API Connect V12 OnPrem deployments running versions 12.1.0.0 through 12.1.1.2 are affected.

Q: What level of access does an attacker need?

Exploitation requires an authenticated attacker with privileged access to IBM API Connect. The issue does not describe unauthenticated exploitation.

Q: What could an attacker do with this issue?

A privileged attacker could cause the system to send unauthorized requests, potentially enumerating network resources and supporting further attacks.

Published Nov 5, 2026

Updated

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

Other sources

IBM API Connect could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

— IBM

Affected Software

1 affected component

IBM API Connect V12 OnPrem<=v12.1.0.0 - v12.1.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:34 AM

Data Sourced

via MITRE·04:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:19 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295635

Frequently Asked Questions

Which deployments are affected?

IBM API Connect V12 OnPrem deployments running versions 12.1.0.0 through 12.1.1.2 are affected.

What level of access does an attacker need?

Exploitation requires an authenticated attacker with privileged access to IBM API Connect. The issue does not describe unauthenticated exploitation.

What could an attacker do with this issue?

A privileged attacker could cause the system to send unauthorized requests, potentially enumerating network resources and supporting further attacks.

CVE-2026-19122: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could an attacker do with this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could an attacker do with this issue?