CVE-2026-17301CVSS 9.8Authentication bypass through signature verification
An unauthenticated attacker can bypass authentication when the product verifies a cryptographic signature incorrectly. Both bulletins list the flaw.
IBM API Connect updates fix authentication bypass and remote code execution
IBM's November 5 API Connect bulletins cover authentication bypasses and code execution, with some issues requiring no login. Upgrade API Connect 10.0.8.0–10.0.8.12 to 10.0.8.13 or V12 OnPrem 12.1.0.0–12.1.1.2 to 12.1.1.3. Individual CVEs differ by release line.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- CVSS 9.9 × 1
- 5 CVEs tracked here
- Splash zone
- Network-reachable IBM API Connect on affected 10.0.8 and V12 OnPrem builds. Authentication requirements differ by vulnerability.
- IBM · API Connect · gateway · authentication
- In the wild
- Unknown
- IBM's bulletins describe vulnerability impact and patches without reporting exploitation.
What happened
The November 5 advisories share some CVEs and have other CVEs specific to each release line. The entries above highlight critical authentication and execution paths. Use the bulletin for your release for the complete vulnerability list and the published prerequisites. The advisory scores are IBM’s CVSS 3.1 base scores. IBM did not publish victim data or confirm active exploitation in these bulletins.
What’s in the bowl
CVE-2026-17117CVSS 9.9Authenticated code execution through object attributes
An authenticated attacker can change an attribute reserved for the system and may execute code. Both bulletins list the flaw.
CVE-2026-17340CVSS 9.8Remote code execution through path traversal
IBM's V12 bulletin lists path traversal leading to code execution and scores it as requiring no privileges.
CVE-2026-17360CVSS 9.8Full administrative control through hard-coded credentials
IBM's V12 bulletin says a remote attacker could gain administrative control through hard-coded credentials.
CVE-2026-16720CVSS 9.8Access token acquisition through directory authentication
Both bulletins list a connected-directory authentication flaw that can allow a remote attacker to obtain another user's access token.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| IBM API Connect 10.0.8.0–10.0.8.12 | 10.0.8.13 | Use the V10 Fix Central package |
| IBM API Connect V12 OnPrem 12.1.0.0–12.1.1.2 | 12.1.1.3 | Use the V12 OnPrem package and upgrade instructions |
Crime-scene timeline
Nov 5, 2026
IBM publishes separate V10 and V12 OnPrem security bulletins
The bulletins give different CVE lists and branch-specific fixes.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- IBM API Connect V12 OnPrem bulletinPrimaryLists the 12.1.0.0–12.1.1.2 affected range, the 12.1.1.3 fix and its full CVE list.
- IBM API Connect V10 bulletinPrimaryLists the 10.0.8.0–10.0.8.12 affected range, the 10.0.8.13 fix and its full CVE list.