critical · CVSS v3 9.4

CVE-2026-17409

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to case-sensitive request handling flaws that allow attacke

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to case-sensitive request handling flaws that allow attackers to bypass access controls and execute administrative actions. This flaw can expose sensitive data and compromise the integrity of the API gateway. The vulnerability is rated critical with a CVSS v3 score of 9.4.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.

Impact

The vulnerability permits unauthorized administrative operations, leading to potential data exfiltration, configuration tampering, and denial of service. Defenders must protect API gateway instances, as attackers could gain full control over the API management platform. The compromise affects confidentiality, integrity, and availability of the API infrastructure.

Remediation

Apply the latest IBM API Connect patches (10.0.8.13 or 12.1.1.3 and later). Verify that request handling is case-sensitive and that access controls are enforced for all URI variations. Restrict administrative endpoints to trusted IP ranges, enable logging of privileged actions, and conduct regular security reviews of API gateway configurations.

Risk context

Given the critical severity (CVSS 9.4) and lack of EPSS data, the risk is high and should be addressed immediately to prevent potential exploitation in production environments.

Affected products

  • IBM API Connect 10.0.8.x
  • IBM API Connect 12.1.x

Scores

Severity
critical
CVSS v2
9.7
CVSS v3
9.4
CVSS v4
—
EPSS
—

IBM API Connect Case Sensitivity Access Control Critical Admin Privileges Remote Exploit

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 have a flaw that lets an authenticated user bypass security restrictions, enabling unauthorized access to sensitive data and configuration changes. The vulnerability is rated critical with a CVSS v3 score of 8.8.

View analysis