critical · CVSS v3 9.8

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without p

Overview

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

Impact

Confidentiality: unauthorized tenants may access data from other tenants. Integrity: attackers can alter or delete tenant configurations. Availability: malicious tenant deletion can disrupt services. Administrators and tenant owners are directly impacted.

Remediation

Apply the official IBM patch for API Connect 12.1.1.2 or later. If patching is delayed, restrict API access to trusted IPs, enforce strict RBAC, and monitor tenant creation/modification logs for anomalies. Ensure that authentication and authorization checks are enabled for all tenant management endpoints.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 9.8, indicating a high likelihood of exploitation and severe impact. Defenders should treat it as an urgent priority.

Affected products

  • IBM API Connect 12.1.0.0
  • IBM API Connect 12.1.1.2

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
—

IBM API Connect tenant authorization critical remote vulnerability

← All CVEs

Related CVEs

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.

View analysis

critical

CVE-2026-16720

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.

View analysis