CVE-2026-75590: Multiple Vulnerabilities in IBM API Connect

Q: Which deployments are affected?

IBM API Connect 12.1.0.0 through 12.1.1.2 are identified as affected.

Q: Is blocking requests to internal IP addresses sufficient mitigation?

No. The issue includes a bypass of a protection intended to block requests to internal addresses, allowing the server to contact internal services despite that control.

Q: What could an attacker obtain through exploitation?

A remote attacker could cause the server to access internal network resources and return part of the responses from internal services, potentially exposing sensitive information.

Published Nov 5, 2026

Updated

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.

Other sources

IBM API Connect could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.

— IBM

Affected Software

1 affected component

IBM API Connect V12 OnPrem<=v12.1.0.0 - v12.1.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 5, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 7, 2026

CVE Published

via MITRE·04:34 AM

Data Sourced

via MITRE·04:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:19 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295635

Frequently Asked Questions

Which deployments are affected?

IBM API Connect 12.1.0.0 through 12.1.1.2 are identified as affected.

Is blocking requests to internal IP addresses sufficient mitigation?

No. The issue includes a bypass of a protection intended to block requests to internal addresses, allowing the server to contact internal services despite that control.

What could an attacker obtain through exploitation?

A remote attacker could cause the server to access internal network resources and return part of the responses from internal services, potentially exposing sensitive information.

CVE-2026-75590: Multiple Vulnerabilities in IBM API Connect

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which deployments are affected?

Is blocking requests to internal IP addresses sufficient mitigation?

What could an attacker obtain through exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Is blocking requests to internal IP addresses sufficient mitigation?

What could an attacker obtain through exploitation?