high · CVSS v3 8.5
CVE-2026-17287
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to server‑side request forgery. An authenticated attacker c
Overview
IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to server‑side request forgery. An authenticated attacker can trick the server into sending requests to arbitrary internal or external addresses, exposing sensitive data. This flaw can lead to data leakage and potential further compromise.
Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
Impact
Confidentiality is compromised as sensitive data can be exfiltrated. Integrity may be affected if attacker can manipulate responses. Availability is not directly impacted. Defenders, especially those managing IBM API Connect deployments, must be aware of this risk.
Remediation
Apply IBM security patches that address CVE-2026-17287 (e.g., upgrade to 10.0.8.13 or 12.1.1.3). If patching is not immediately possible, restrict API Connect's outbound network access using firewall rules or network segmentation to limit destinations. Additionally, enable strict input validation or whitelist acceptable URLs.
Risk context
High severity CVE with no EPSS data; defenders should treat it as a priority vulnerability requiring timely patching or mitigation.
Affected products
- IBM API Connect 10.0.8.x
- IBM API Connect 12.1.x
Scores
- Severity
- high
- CVSS v2
- 7.5
- CVSS v3
- 8.5
- CVSS v4
- —
- EPSS
- —