Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

IBM API Connect can expose data via unauthenticated requests

CVE-2026-17344 · published today
Summary

Versions 12.1.0.0 through 12.1.1.2 of IBM API Connect allow an attacker to make the system send requests to other sites without logging in, potentially revealing confidential information. This occurs because the server can be tricked into contacting external destinations on the attacker’s behalf. Apply the latest security updates from IBM and restrict unauthenticated access to internal services.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm api connect <= 12.1.1.2
Original advisory text
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published7 Nov 2026
Updated7 Nov 2026
First seen7 Nov 2026
Sources
CVE-2026-17344 · NVD
CVE-2026-17344 · MITRE
Track software like this
Free during beta