Pages Node 7295635

CVEID: CVE-2026-17064 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17129 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) CVEID: CVE-2026-17237 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17409 DESCRIPTION: IBM API Connect could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached. CWE: CWE-178: Improper Handling of Case Sensitivity CVSS Source: IBM CVSS Base score: 9.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) CVEID: CVE-2026-108178 DESCRIPTION: IBM API Connect could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for. CWE: CWE-358: Improperly Implemented Security Check for Standard CVSS Source: IBM CVSS Base score: 4.2 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17332 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass security restrictions due to improper certificate validation. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 8.7 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17313 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path. CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17395 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17369 DESCRIPTION: IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker. CWE: CWE-352: Cross-Site Request Forgery CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17299 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17341 DESCRIPTION: IBM API Connect could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.2 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17305 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17131 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to unintended destinations and return the response. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17319 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base score: 7.1 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L) CVEID: CVE-2026-17279 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable. CWE: CWE-400: Uncontrolled Resource Consumption CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) CVEID: CVE-2026-17304 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17230 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) CVEID: CVE-2026-17317 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) CVEID: CVE-2026-17360 DESCRIPTION: IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials. CWE: CWE-798: Use of Hard-coded Credentials CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-16880 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17365 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17117 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution. CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17326 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 8.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17330 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17297 DESCRIPTION: IBM API Connect could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. CWE: CWE-601: URL Redirection to Untrusted Site CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17108 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17339 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 9.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) CVEID: CVE-2026-17139 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17320 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17352 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17428 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17312 DESCRIPTION: IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker. CWE: CWE-352: Cross-Site Request Forgery CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17381 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17331 DESCRIPTION: IBM API Connect could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path. CWE: CWE-73: External Control of File Name or Path CVSS Source: IBM CVSS Base score: 7.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17340 DESCRIPTION: IBM API Connect could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17388 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17188 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17144 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17140 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 3.3 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-16711 DESCRIPTION: IBM API Connect could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests. CWE: CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2026-17202 DESCRIPTION: IBM API Connect could allow a remote attacker to enumerate usernames due to observable differences in response behavior. CWE: CWE-204: Observable Response Discrepancy CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17066 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base score: 9.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17214 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass security restrictions due to LDAP injection. CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query CVSS Source: IBM CVSS Base score: 4.8 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17336 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-16884 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection. CWE: CWE-611: Improper Restriction of XML External Entity Reference CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) CVEID: CVE-2026-17301 DESCRIPTION: IBM API Connect could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature. CWE: CWE-347: Improper Verification of Cryptographic Signature CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17404 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17390 DESCRIPTION: IBM API Connect could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17329 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17231 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to an observable response discrepancy. CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS Source: IBM CVSS Base score: 5.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-16719 DESCRIPTION: IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17362 DESCRIPTION: IBM API Connect could allow a remote attacker to create, modify, or delete tenants due to missing authorization. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17318 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17225 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented. CWE: CWE-235: Improper Handling of Extra Parameters CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17333 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 8 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17394 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information. CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17316 DESCRIPTION: IBM API Connect could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.2 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16715 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17238 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16918 DESCRIPTION: IBM API Connect could allow a remote attacker to access internal network resources due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17325 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17150 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant. CWE: CWE-184: Incomplete List of Disallowed Inputs CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-19129 DESCRIPTION: IBM API Connect could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17167 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details. CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2026-17363 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17342 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17292 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 9.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) CVEID: CVE-2026-17236 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16712 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17371 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17374 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17358 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 8.2 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17357 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network services due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17314 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17403 DESCRIPTION: IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials. CWE: CWE-798: Use of Hard-coded Credentials CVSS Source: IBM CVSS Base score: 9 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17241 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17289 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17228 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17282 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-18836 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17321 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) CVEID: CVE-2026-16920 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability. CWE: CWE-441: Unintended Proxy or Intermediary CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-16716 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment. CWE: CWE-1259: Improper Restriction of Security Token Assignment CVSS Source: IBM CVSS Base score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17172 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. CWE: CWE-290: Authentication Bypass by Spoofing CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17293 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17366 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17187 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-16854 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-19131 DESCRIPTION: IBM API Connect could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17302 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17361 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17155 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16720 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17306 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17405 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17295 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17067 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network resources due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17391 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.3 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17372 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17345 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17284 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.1 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17128 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files. CWE: CWE-532: Insertion of Sensitive Information into Log File CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17382 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-16679 DESCRIPTION: IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17211 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable. CWE: CWE-704: Incorrect Type Conversion or Cast CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2026-17354 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-16912 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17338 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 9.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) CVEID: CVE-2026-17085 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent. CWE: CWE-178: Improper Handling of Case Sensitivity CVSS Source: IBM CVSS Base score: 4.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) CVEID: CVE-2026-17294 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17049 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17309 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 8 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17337 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication. CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization CVSS Source: IBM CVSS Base score: 7.4 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17137 DESCRIPTION: IBM API Connect could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection. CWE: CWE-329: Generation of Predictable IV with CBC Mode CVSS Source: IBM CVSS Base score: 4 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-18838 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user. CWE: CWE-290: Authentication Bypass by Spoofing CVSS Source: IBM CVSS Base score: 9.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) CVEID: CVE-2026-19122 DESCRIPTION: IBM API Connect could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 3.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17398 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17411 DESCRIPTION: IBM API Connect could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) CVEID: CVE-2026-17287 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17392 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant. CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17146 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17359 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17098 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to verbose error messages. CWE: CWE-209: Generation of Error Message Containing Sensitive Information CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17327 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17322 DESCRIPTION: IBM API Connect could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files. CWE: CWE-532: Insertion of Sensitive Information into Log File CVSS Source: IBM CVSS Base score: 7.1 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17281 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17335 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17408 DESCRIPTION: IBM API Connect could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command. CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17307 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17402 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host. CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17215 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information the system than necessary, which could help an attacker learn the environment. CWE: CWE-209: Generation of Error Message Containing Sensitive Information CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17288 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-16717 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker t...