high · CVSS v3 7.6

CVE-2026-17411

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to SQL injection that can be exploited by authenticated use

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to SQL injection that can be exploited by authenticated users. The flaw allows attackers to read, modify, or delete backend database data. This can lead to data loss, corruption, and unauthorized disclosure.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.

Impact

Confidentiality: unauthorized data exposure. Integrity: data can be altered or deleted. Availability: potential disruption if critical data is corrupted. Defenders should monitor for anomalous DB activity and enforce least privilege.

Remediation

Apply IBM security patch for API Connect 10.0.8.12 or upgrade to 10.0.8.13/12.1.1.3. Ensure input validation and parameterized queries. Restrict authenticated user privileges and monitor logs.

Risk context

Severity high (CVSS 7.6). No EPSS data available. Immediate patching is recommended to mitigate risk of data compromise.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0

Scores

Severity
high
CVSS v2
8
CVSS v3
7.6
CVSS v4
—
EPSS
—

SQL Injection IBM API Connect Data Breach High Severity Authentication Database Patch

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis