critical · CVSS v3 9.3

CVE-2026-18836

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to server-side request forgery, allowing a remote attacker

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to server-side request forgery, allowing a remote attacker to force the server to request arbitrary URLs and return the response. This can expose internal network resources and sensitive data. The flaw is critical with a CVSS v3 score of 9.3.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.

Impact

The vulnerability can compromise confidentiality by leaking internal data, affect integrity by enabling unauthorized data retrieval, and potentially disrupt availability if the server is overwhelmed. Defenders using IBM API Connect must consider the risk of internal network exposure and data exfiltration.

Remediation

Apply the latest IBM security patch for CVE-2026-18836 or upgrade to a fixed version (e.g., 10.0.8.13 or 12.1.1.3). In the interim, restrict outbound traffic from the API Connect server, enforce strict firewall rules, and disable or isolate any endpoints that can trigger SSRF.

Risk context

The issue is rated critical with a CVSS v3 score of 9.3, indicating a high likelihood of severe impact. Immediate action is recommended to mitigate potential data exposure or further exploitation.

Affected products

  • IBM API Connect 10.0.8
  • IBM API Connect 12.1.0

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.3
CVSS v4
—
EPSS
—

SSRF IBM API Connect Critical Server-side request forgery Remote Patch

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 have a flaw that lets an authenticated user bypass security restrictions, enabling unauthorized access to sensitive data and configuration changes. The vulnerability is rated critical with a CVSS v3 score of 8.8.

View analysis