IBM API Connect: 25 Vulnerabilities Disclosed in Single Batch
A batch of 25 CVEs affecting IBM API Connect was disclosed on November 7, 2026, with severities ranging from Low to Critical.
Key findings
- 25 CVEs affecting IBM API Connect disclosed on November 7, 2026.
- Vulnerabilities include critical flaws like SSRF, SQL injection, and remote code execution.
- Authentication and authorization bypasses are prevalent across multiple CVEs.
- Affected versions include 10.0.8.x and 12.1.0.x through 12.1.1.2.
- Severities range from Low (3.8) to Critical (9.9).
IBM API Connect Plagued by 25 Vulnerabilities in Synchronized Disclosure
On November 7, 2026, a significant batch of 25 vulnerabilities was disclosed for IBM API Connect, impacting versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerabilities, with a CVSSv3 score range from 3.8 (Low) to 9.9 (Critical), were disclosed together, suggesting a coordinated release of security information. These flaws expose the API management platform to a wide array of risks, including unauthorized access, sensitive data exposure, and remote code execution.
Authentication and Authorization Flaws
A substantial number of these vulnerabilities stem from improper authentication and authorization mechanisms. CVE-2026-18838 (Critical, 9.4) allows a remote attacker to obtain sensitive information and modify API configurations due to insufficient verification of identity information. Similarly, CVE-2026-19121 (High, 8.3) permits an authenticated attacker to gain unauthorized access by exploiting insufficient tenant context verification. Further complicating security, CVE-2026-17405 (High, 8.8) involves broken object-level authorization, potentially exposing keystore information. CVE-2026-18689 (Medium, 4.3) and CVE-2026-17428 (Medium, 5.0) also highlight authorization weaknesses, allowing limited information disclosure and access to sensitive data, respectively.
Server-Side Request Forgery (SSRF)
Several critical vulnerabilities are attributed to Server-Side Request Forgery (SSRF). CVE-2026-75590 (High, 7.2), CVE-2026-19128 (High, 7.5), CVE-2026-18836 (Critical, 9.3), and CVE-2026-17406 (High, 8.5) all involve SSRF flaws that can be exploited by attackers to access internal network resources, obtain sensitive information, or send requests to unintended destinations. CVE-2026-17404 (High, 8.5) also falls into this category, allowing attackers to obtain sensitive information.
Code Execution and Data Manipulation
Of particular concern are the vulnerabilities that could lead to remote code execution and significant data manipulation. CVE-2026-17408 (Critical, 9.8) and CVE-2026-17402 (Critical, 9.0) allow remote attackers to execute arbitrary code or gain full administrative control, respectively, due to improper neutralization of OS commands or the use of hard-coded credentials. SQL injection vulnerabilities, including CVE-2026-17414 (High, 7.6), CVE-2026-17407 (High, 8.5), and CVE-2026-17400 (High, 7.7), enable attackers to view, add, modify, or delete data in the back-end database. Furthermore, CVE-2026-17410 (Critical, 9.9) allows attackers to access and modify other tenants' portal data, while CVE-2026-17403 (Critical, 9.9) enables arbitrary command execution through OS command injection.
Cryptographic Weaknesses and Denial of Service
Other vulnerabilities include weaker-than-expected cryptographic algorithms (CVE-2026-19126, Medium, 5.9) and the use of a hard-coded cryptographic key (CVE-2026-19124, Medium, 6.8), which could allow attackers to decrypt sensitive information. CVE-2026-19129 (Medium, 6.8) involves improper verification of the backup server