critical · CVSS v3 9.9

CVE-2026-17336

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands …

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-17292

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.

View analysis

critical

CVE-2026-17296

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

View analysis

critical

CVE-2026-17297

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain an open redirect flaw in the sign-in flow that can lead to account takeover. The flaw allows an attacker to redirect authentication responses to a malicious site, enabling credential theft. Patching or hardening the redirect validation mitigates the risk.

View analysis

critical

CVE-2026-17298

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

View analysis