critical · CVSS v3 8.8

CVE-2026-17405

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 have a flaw that allows a logged‑in attacker to read keystore objects with

Overview

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 have a flaw that allows a logged‑in attacker to read keystore objects without proper authorization. This can expose cryptographic keys and other sensitive data. The vulnerability is critical and requires immediate attention.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.

Impact

Confidentiality: keystore contents may be disclosed to unauthorized users. Integrity: attackers could tamper with key material if they gain write access. Availability: not directly impacted. Defenders: administrators of IBM API Connect environments must ensure proper role‑based access controls and apply patches.

Remediation

Apply the latest IBM API Connect patch that fixes the object‑level authorization check for keystore objects. Verify that only users with the 'Keystore Reader' role can access keystore data. If a patch is unavailable, restrict keystore access via network segmentation or firewall rules and enforce least‑privilege RBAC.

Risk context

Severity is critical with a CVSS v3 score of 8.8. The lack of EPSS data means the risk remains high; defenders should treat this as an urgent issue.

Affected products

  • IBM API Connect 10.0.8.0‑10.0.8.12
  • IBM API Connect 12.1.0.0‑12.1.1.2

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
—

IBM API Connect keystore authorization critical confidentiality RBAC

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 have a flaw that lets an authenticated user bypass security restrictions, enabling unauthorized access to sensitive data and configuration changes. The vulnerability is rated critical with a CVSS v3 score of 8.8.

View analysis