Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Vulnerability Details

CVEID:   CVE-2026-17064
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17129
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID:   CVE-2026-17237
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17409
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
CWE:   CWE-178: Improper Handling of Case Sensitivity
CVSS Source:   IBM
CVSS Base score:   9.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

CVEID:   CVE-2026-108178
DESCRIPTION:   IBM API Connect could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CWE:   CWE-358: Improperly Implemented Security Check for Standard
CVSS Source:   IBM
CVSS Base score:   4.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17332
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to improper certificate validation.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17313
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.
CWE:   CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17395
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17369
DESCRIPTION:   IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
CWE:   CWE-352: Cross-Site Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17299
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17341
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17305
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17131
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17319
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L)

CVEID:   CVE-2026-17279
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable.
CWE:   CWE-400: Uncontrolled Resource Consumption
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

CVEID:   CVE-2026-17304
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17230
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

CVEID:   CVE-2026-17317
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)

CVEID:   CVE-2026-17360
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-16880
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17365
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17117
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
CWE:   CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17326
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17330
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17297
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CWE:   CWE-601: URL Redirection to Untrusted Site
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17108
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17339
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L)

CVEID:   CVE-2026-17139
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17320
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17352
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17428
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17312
DESCRIPTION:   IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
CWE:   CWE-352: Cross-Site Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17381
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17331
DESCRIPTION:   IBM API Connect could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.
CWE:   CWE-73: External Control of File Name or Path
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17340
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17388
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17188
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17144
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CWE:   CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17140
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   3.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-16711
DESCRIPTION:   IBM API Connect could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-17202
DESCRIPTION:   IBM API Connect could allow a remote attacker to enumerate usernames due to observable differences in response behavior.
CWE:   CWE-204: Observable Response Discrepancy
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17066
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17214
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to LDAP injection.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   4.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17336
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-16884
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L)

CVEID:   CVE-2026-17301
DESCRIPTION:   IBM API Connect could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17404
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17390
DESCRIPTION:   IBM API Connect could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17329
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17231
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.
CWE:   CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Source:   IBM
CVSS Base score:   5.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-16719
DESCRIPTION:   IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17362
DESCRIPTION:   IBM API Connect could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17318
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17225
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.
CWE:   CWE-235: Improper Handling of Extra Parameters
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17333
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17394
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
CWE:   CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17316
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16715
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17238
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16918
DESCRIPTION:   IBM API Connect could allow a remote attacker to access internal network resources due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17325
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17150
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
CWE:   CWE-184: Incomplete List of Disallowed Inputs
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-19129
DESCRIPTION:   IBM API Connect could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17167
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details.
CWE:   CWE-807: Reliance on Untrusted Inputs in a Security Decision
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-17363
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17342
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17292
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L)

CVEID:   CVE-2026-17236
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16712
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17371
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17374
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17358
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17357
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17314
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17403
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17241
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17289
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17228
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17282
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-18836
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17321
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

CVEID:   CVE-2026-16920
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
CWE:   CWE-441: Unintended Proxy or Intermediary
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-16716
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
CWE:   CWE-1259: Improper Restriction of Security Token Assignment
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17172
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17293
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17366
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17187
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16854
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-19131
DESCRIPTION:   IBM API Connect could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17302
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17361
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17155
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16720
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17306
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17405
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17295
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17067
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17391
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17372
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17345
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17284
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17128
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
CWE:   CWE-532: Insertion of Sensitive Information into Log File
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17382
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16679
DESCRIPTION:   IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17211
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.
CWE:   CWE-704: Incorrect Type Conversion or Cast
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2026-17354
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-16912
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17338
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)

CVEID:   CVE-2026-17085
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.
CWE:   CWE-178: Improper Handling of Case Sensitivity
CVSS Source:   IBM
CVSS Base score:   4.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N)

CVEID:   CVE-2026-17294
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17049
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17309
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17337
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.
CWE:   CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17137
DESCRIPTION:   IBM API Connect could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
CWE:   CWE-329: Generation of Predictable IV with CBC Mode
CVSS Source:   IBM
CVSS Base score:   4
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-18838
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   9.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

CVEID:   CVE-2026-19122
DESCRIPTION:   IBM API Connect could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   3.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17398
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17411
DESCRIPTION:   IBM API Connect could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID:   CVE-2026-17287
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17392
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17146
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17359
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17098
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to verbose error messages.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17327
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17322
DESCRIPTION:   IBM API Connect could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
CWE:   CWE-532: Insertion of Sensitive Information into Log File
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17281
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17335
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17408
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CWE:   CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17307
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17402
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
CWE:   CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17215
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information about the system than necessary, which could help an attacker learn about the environment.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17288
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16717
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17396
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17315
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17285
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17379
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17406
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17303
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17323
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
CWE:   CWE-611: Improper Restriction of XML External Entity Reference
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)

CVEID:   CVE-2026-17147
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17308
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-16718
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-16709
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17232
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-105459
DESCRIPTION:   IBM API Connect could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)

CVEID:   CVE-2026-17355
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17233
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain information about internal network services due to improper validation of user-supplied URLs. Addresses supplied by users are not sufficiently restricted, so the server could be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17387
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17407
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17343
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-19121
DESCRIPTION:   IBM API Connect could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   8.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)

CVEID:   CVE-2026-17311
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L)

CVEID:   CVE-2026-19128
DESCRIPTION:   IBM API Connect could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17373
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17132
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17134
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)

CVEID:   CVE-2026-17158
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17397
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17356
DESCRIPTION:   IBM API Connect could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CWE:   CWE-321: Use of Hard-coded Cryptographic Key
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17298
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17334
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17278
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17190
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17410
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CWE:   CWE-88: Improper Neutralization of Argument Delimiters in a Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17376
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17240
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to improper authentication. Authentication checks are not applied consistently, which could allow protected resources to be reached without valid credentials.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

CVEID:   CVE-2026-17385
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17290
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17367
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CWE:   CWE-522: Insufficiently Protected Credentials
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17401
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CWE:   CWE-121: Stack-based Buffer Overflow
CVSS Source:   IBM
CVSS Base score:   7.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17291
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CWE:   CWE-601: URL Redirection to Untrusted Site
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-18689
DESCRIPTION:   IBM API Connect could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   4.3
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17400
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17370
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17380
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17112
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-75590
DESCRIPTION:   IBM API Connect could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17324
DESCRIPTION:   IBM API Connect could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.
CWE:   CWE-306: Missing Authentication for Critical Functionality
CVSS Source:   IBM
CVSS Base score:   8.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)

CVEID:   CVE-2026-17399
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
CWE:   CWE-434: Unrestricted Upload of File with Dangerous Type
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-19126
DESCRIPTION:   IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CWE:   CWE-916: Use of Password Hash With Insufficient Computational Effort
CVSS Source:   IBM
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17344
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17378
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17375
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17368
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17310
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CWE:   CWE-321: Use of Hard-coded Cryptographic Key
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17383
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17244
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not verify that the user is permitted to act on the targeted resource, which could allow other users' API keys to be deleted.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)

CVEID:   CVE-2026-17280
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.
CWE:   CWE-307: Improper Restriction of Excessive Authentication Attempts
CVSS Source:   IBM
CVSS Base score:   8.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)

CVEID:   CVE-2026-17353
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17328
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16710
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17062
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.
CWE:   CWE-88: Improper Neutralization of Argument Delimiters in a Command
CVSS Source:   IBM
CVSS Base score:   2.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-17377
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.
CWE:   CWE-117: Improper Output Neutralization for Logs
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)

CVEID:   CVE-2026-16714
DESCRIPTION:   IBM API Connect could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17114
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

CVEID:   CVE-2026-17239
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17154
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17389
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17283
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17296
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17143
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CWE:   CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

ID:   CVE-2026-105002
DESCRIPTION:   IBM API Connect could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)