Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Vulnerability Details

CVEID:   CVE-2026-17405
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17365
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17215
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information about the system than necessary, which could help an attacker learn about the environment.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-105459
DESCRIPTION:   IBM API Connect could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)

CVEID:   CVE-2026-16918
DESCRIPTION:   IBM API Connect could allow a remote attacker to access internal network resources due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16720
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17384
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17358
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   8.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-16719
DESCRIPTION:   IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17244
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not verify that the user is permitted to act on the targeted resource, which could allow other users' API keys to be deleted.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)

CVEID:   CVE-2026-17158
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17295
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17233
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain information about internal network services due to improper validation of user-supplied URLs. Addresses supplied by users are not sufficiently restricted, so the server could be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17357
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17307
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17399
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
CWE:   CWE-434: Unrestricted Upload of File with Dangerous Type
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17394
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
CWE:   CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17411
DESCRIPTION:   IBM API Connect could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID:   CVE-2026-17140
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   3.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17386
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.
CWE:   CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-18689
DESCRIPTION:   IBM API Connect could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   4.3
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-16714
DESCRIPTION:   IBM API Connect could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17395
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16716
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
CWE:   CWE-1259: Improper Restriction of Security Token Assignment
CVSS Source:   IBM
CVSS Base score:   8.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17146
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17428
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17280
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.
CWE:   CWE-307: Improper Restriction of Excessive Authentication Attempts
CVSS Source:   IBM
CVSS Base score:   8.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)

CVEID:   CVE-2026-17064
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17380
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17301
DESCRIPTION:   IBM API Connect could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-16709
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17292
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   9.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L)

CVEID:   CVE-2026-17139
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17389
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17376
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17383
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-108178
DESCRIPTION:   IBM API Connect could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CWE:   CWE-358: Improperly Implemented Security Check for Standard
CVSS Source:   IBM
CVSS Base score:   4.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17172
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17402
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
CWE:   CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17289
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17385
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17401
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CWE:   CWE-121: Stack-based Buffer Overflow
CVSS Source:   IBM
CVSS Base score:   7.2
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17297
DESCRIPTION:   IBM API Connect could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CWE:   CWE-601: URL Redirection to Untrusted Site
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17281
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-18836
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17379
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.
CWE:   CWE-347: Improper Verification of Cryptographic Signature
CVSS Source:   IBM
CVSS Base score:   7.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17279
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable.
CWE:   CWE-400: Uncontrolled Resource Consumption
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

CVEID:   CVE-2026-17393
DESCRIPTION:   IBM API Connect could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator.
CWE:   CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CVSS Source:   IBM
CVSS Base score:   5.1
CVSS Vector:   (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17333
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17114
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

CVEID:   CVE-2026-19124
DESCRIPTION:   IBM API Connect could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17410
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CWE:   CWE-88: Improper Neutralization of Argument Delimiters in a Command
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17117
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
CWE:   CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17378
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-16912
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17388
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17404
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-16711
DESCRIPTION:   IBM API Connect could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-16679
DESCRIPTION:   IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17374
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-16718
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17370
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17225
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.
CWE:   CWE-235: Improper Handling of Extra Parameters
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17326
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   8.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17396
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17342
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17098
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to verbose error messages.
CWE:   CWE-209: Generation of Error Message Containing Sensitive Information
CVSS Source:   IBM
CVSS Base score:   5.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17392
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17408
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CWE:   CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17375
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17400
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17062
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.
CWE:   CWE-88: Improper Neutralization of Argument Delimiters in a Command
CVSS Source:   IBM
CVSS Base score:   2.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-17390
DESCRIPTION:   IBM API Connect could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17367
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CWE:   CWE-522: Insufficiently Protected Credentials
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17241
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17298
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17214
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to LDAP injection.
CWE:   CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
CVSS Source:   IBM
CVSS Base score:   4.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17398
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17285
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17067
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17296
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17409
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
CWE:   CWE-178: Improper Handling of Case Sensitivity
CVSS Source:   IBM
CVSS Base score:   9.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

CVEID:   CVE-2026-17368
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17318
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-19126
DESCRIPTION:   IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CWE:   CWE-916: Use of Password Hash With Insufficient Computational Effort
CVSS Source:   IBM
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2026-17381
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17232
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17366
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17230
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

CVEID:   CVE-2026-17288
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17305
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17373
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CWE:   CWE-863: Incorrect Authorization
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17237
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17291
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.
CWE:   CWE-601: URL Redirection to Untrusted Site
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17282
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17284
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17147
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17144
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CWE:   CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2026-17382
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17387
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17236
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17345
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-16712
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17391
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   6.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17372
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17150
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
CWE:   CWE-184: Incomplete List of Disallowed Inputs
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17085
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.
CWE:   CWE-178: Improper Handling of Case Sensitivity
CVSS Source:   IBM
CVSS Base score:   4.1
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N)

CVEID:   CVE-2026-17238
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-17371
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17293
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17211
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.
CWE:   CWE-704: Incorrect Type Conversion or Cast
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2026-17363
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17322
DESCRIPTION:   IBM API Connect could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
CWE:   CWE-532: Insertion of Sensitive Information into Log File
CVSS Source:   IBM
CVSS Base score:   7.1
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17290
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.
CWE:   CWE-290: Authentication Bypass by Spoofing
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

CVEID:   CVE-2026-17406
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17369
DESCRIPTION:   IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
CWE:   CWE-352: Cross-Site Request Forgery
CVSS Source:   IBM
CVSS Base score:   5.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:   CVE-2026-17377
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.
CWE:   CWE-117: Improper Output Neutralization for Logs
CVSS Source:   IBM
CVSS Base score:   5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)

CVEID:   CVE-2026-19129
DESCRIPTION:   IBM API Connect could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.
CWE:   CWE-295: Improper Certificate Validation
CVSS Source:   IBM
CVSS Base score:   6.8
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CVEID:   CVE-2026-17397
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17112
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17294
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17403
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   9
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17359
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   9.9
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17287
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17407
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
CWE:   CWE-89: Improper Neutralization of Special Elements used in an SQL Command
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2026-17303
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   6.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

CVEID:   CVE-2026-16715
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-17231
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.
CWE:   CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS Source:   IBM
CVSS Base score:   5.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2026-17143
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CWE:   CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVSS Source:   IBM
CVSS Base score:   4.3
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

CVEID:   CVE-2026-17190
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.
CWE:   CWE-79: Improper Neutralization of Input During Web Page Generation
CVSS Source:   IBM
CVSS Base score:   8.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17283
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CWE:   CWE-639: Authorization Bypass Through User-Controlled Key
CVSS Source:   IBM
CVSS Base score:   7.7
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2026-16880
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CWE:   CWE-22: Improper Limitation of a Pathname to a Restricted Directory
CVSS Source:   IBM
CVSS Base score:   8.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

CVEID:   CVE-2026-17299
DESCRIPTION:   IBM API Connect could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.
CWE:   CWE-918: Server-Side Request Forgery
CVSS Source:   IBM
CVSS Base score:   9.6
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2026-17240
DESCRIPTION:   IBM API Connect could allow a remote attacker to bypass security restrictions due to improper authentication. Authentication checks are not applied consistently, which could allow protected resources to be reached without valid credentials.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   6.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

ID:   CVE-2026-105002
DESCRIPTION:   IBM API Connect could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
CWE:   CWE-94: Improper Control of Generation of Code
CVSS Source:   IBM
CVSS Base score:   7.5
CVSS Vector:   (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)