high · CVSS v3 8.5

CVE-2026-17407

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated SQL injection during sign‑in. The

Overview

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated SQL injection during sign‑in. The flaw allows attackers to execute arbitrary SQL commands against the backend database. This can lead to data exposure, modification, or denial of service.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.

Impact

Confidentiality: attackers can read sensitive data from the database. Integrity: they can modify or delete records, corrupting API data. Availability: repeated exploitation could exhaust database resources, causing service disruption. The primary impact is on organizations running the affected API Connect versions.

Remediation

Apply the official IBM security patch that fixes the SQL injection in the sign‑in flow. If a patch is unavailable, restrict authentication to trusted IP ranges and enforce strict input validation on the sign‑in endpoint. Monitor database logs for anomalous queries and consider disabling unused API Connect services.

Risk context

The vulnerability has a high severity score of 8.5 and is exploitable by authenticated users, making it urgent for affected deployments to patch or mitigate immediately.

Affected products

  • IBM API Connect 10.0.8.x
  • IBM API Connect 12.1.0.x

Scores

Severity
high
CVSS v2
7.1
CVSS v3
8.5
CVSS v4
—
EPSS
—

sql-injection ibm-api-connect authentication database high-severity

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis