high · CVSS v3 7.2

CVE-2026-17401

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a stack-based buffer overflow that allows a remote authenticated a

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 contain a stack-based buffer overflow that allows a remote authenticated attacker to execute arbitrary code. The flaw can be triggered by crafted API requests and may compromise the entire API Connect deployment. It is important for organizations to patch or mitigate this vulnerability promptly.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

Impact

Confidentiality: attacker can read or modify data exposed through APIs. Integrity: attacker can alter or delete API configurations. Availability: attacker can crash the API Connect service. The vulnerability affects administrators and users who authenticate to the API Connect platform.

Remediation

Apply the latest IBM API Connect patch that addresses CVE-2026-17401 (e.g., upgrade to 10.0.8.13 or 12.1.1.3). If patching is not immediately possible, restrict network access to the API Connect management interface, enforce least-privilege authentication, and monitor for anomalous API calls.

Risk context

Severity is high with a CVSS v3 score of 7.2. No EPSS data is available, but the high severity indicates a significant risk that should be addressed promptly.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
—
EPSS
—

buffer-overflow remote-code-execution IBM API-Connect high-severity authentication patch

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis