Vulnerability details

CVE-2026-17131

IBM API Connect

Multiple Vulnerabilities in IBM API Connect

CVSS 3.1

9.3Critical

Official description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

CVSS scores

Score	Version	Source	Vector
9.3Critical	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
IBM	API Connect	12.1.0.0 ≤ v ≤ 12.1.1.2	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7295635 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-07
Last updated: 2026-11-07
State: Published
Assigner (CNA): ibm
Kolun priority: 24 · Low

Exploit prediction (EPSS)

0.44%

Probability of exploitation in 30 days

38.5%

Percentile (among all CVEs)

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery