high · CVSS v3 7.5

CVE-2026-19128

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server‑side request forgery, allowing authenticated users to issue arbi

Overview

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to server‑side request forgery, allowing authenticated users to issue arbitrary requests from the host. This flaw can enable attackers to enumerate internal network resources or facilitate further exploitation. The vulnerability is rated high severity with a CVSS v3 score of 7.5.

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

Impact

Confidentiality: internal network data may be disclosed. Integrity: attackers could manipulate or exfiltrate data via forged requests. Availability: potential for resource exhaustion if abused. Defenders and system administrators are directly impacted.

Remediation

Apply the latest IBM API Connect patch (12.1.1.3 or later) or upgrade to a supported version. Restrict outbound traffic from the API Connect server using firewall rules or network segmentation. Disable or limit the use of the affected API endpoints and enforce strict authentication and authorization controls.

Risk context

The vulnerability is classified as high severity (CVSS 7.5) with no EPSS data available, indicating a significant risk that requires prompt attention and remediation.

Affected products

  • IBM API Connect 12.1.0.0
  • IBM API Connect 12.1.1.2

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

SSRF IBM API Connect High Severity Authentication Network Enumeration

← All CVEs

Related CVEs

high

CVE-2026-16715

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 have a broken object-level authorization flaw that lets a remote authenticated user read data belonging to other tenants. This can expose sensitive tenant data and compromise isolation boundaries. The vulnerability is rated high with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16717

IBM API Connect versions 12.1.0.0 to 12.1.1.2 have a flaw that allows authenticated attackers to bypass object-level authorization and access sensitive data. The vulnerability can lead to data exposure and compromise of confidential information. It is rated high severity with a CVSS v3 score of 7.7.

View analysis

high

CVE-2026-16718

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated information disclosure due to improper file path validation. An attacker with valid credentials can read sensitive files on the host. This can expose configuration, credentials, or other confidential data.

View analysis

high

CVE-2026-16854

IBM API Connect 12.1.0.0 through 12.1.1.2 is vulnerable to a remote authenticated injection that can expose data from other tenants. The flaw allows attackers to craft queries that return unauthorized sensitive information. This impacts multi-tenant deployments where tenant isolation is critical.

View analysis