critical · CVSS v3 9.9

CVE-2026-17392

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to …

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-17329

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.

View analysis

critical

CVE-2026-17335

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

View analysis

critical

CVE-2026-17336

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

View analysis

critical

CVE-2026-17338

IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to access sensitive data. The flaw can expose confidential configuration and user information. It is critical because it bypasses normal access controls.

View analysis