high · CVSS v3 7.7

CVE-2026-17285

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to …

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.

View analysis

high

CVE-2026-16880

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

View analysis

high

CVE-2026-16912

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to a server-side request forgery that allows a logged-in attacker to read sensitive data. The flaw can be triggered by crafted API calls and does not require elevated privileges beyond normal user accounts. This can expose internal network resources and confidential configuration information.

View analysis

high

CVE-2026-17108

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server‑side request forgery (SSRF) that can be triggered by a remote authenticated attacker. The flaw allows the attacker to send arbitrary requests from the API gateway, potentially exposing sensitive internal resources. This vulnerability is classified as high severity with a CVSS v3 score of 8.5.

View analysis