CVE-2026-17409criticalCWE-178

CVE-2026-17409: critical vulnerability in IBM API Connect

Multiple Vulnerabilities in IBM API Connect

Published

Follow this CVE+ Monitor API Connect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected products
IBM · API Connect
Related CVEs — IBM API Connect

In the same product, most dangerous first.

CVE-2025-13915CRITICALAuthentication bypass in IBM API ConnectEPSS 9.0%CVE-2019-4382MEDIUMCVE-2019-4382EPSS 7.8%CVE-2019-4202CRITICALCVE-2019-4202EPSS 4.2%CVE-2018-1778HIGHCVE-2018-1778EPSS 3.4%CVE-2018-1932MEDIUMCVE-2018-1932EPSS 3.2%CVE-2018-2011MEDIUMCVE-2018-2011EPSS 2.8%