Vulnerability details

CVE-2026-17355

IBM API Connect

Multiple Vulnerabilities in IBM API Connect

CVSS 3.1

8.2High

Official description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

CVSS scores

Score	Version	Source	Vector
8.2High	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
IBM	API Connect	12.1.0.0 ≤ v ≤ 12.1.1.2	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7295635 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-07
Last updated: 2026-11-07
State: Published
Assigner (CNA): ibm

Exploit prediction (EPSS)

0.36%

Probability of exploitation in 30 days

30.7%

Percentile (among all CVEs)

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery