critical · CVSS v3 9.4

CVE-2026-18838

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API c…

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.

Scores

Severity
critical
CVSS v2
9.7
CVSS v3
9.4
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-17329

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.

View analysis

critical

CVE-2026-17335

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

View analysis

critical

CVE-2026-17336

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

View analysis

critical

CVE-2026-17338

IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to access sensitive data. The flaw can expose confidential configuration and user information. It is critical because it bypasses normal access controls.

View analysis