Pages Node 7295637

CVEID: CVE-2026-17405 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17365 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17215 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information the system than necessary, which could help an attacker learn the environment. CWE: CWE-209: Generation of Error Message Containing Sensitive Information CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-105459 DESCRIPTION: IBM API Connect could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation. CWE: CWE-347: Improper Verification of Cryptographic Signature CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) CVEID: CVE-2026-16918 DESCRIPTION: IBM API Connect could allow a remote attacker to access internal network resources due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-16720 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17384 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17358 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 8.2 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-16719 DESCRIPTION: IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17244 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not verify that the user is permitted to act on the targeted resource, which could allow other users' API keys to be deleted. CWE: CWE-862: Missing Authorization CVSS Source: IBM CVSS Base score: 7.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) CVEID: CVE-2026-17158 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to gain elevated privileges due to improper authentication. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17295 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to path traversal. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17233 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain information internal network services due to improper validation of user-supplied URLs. Addresses supplied by users are not sufficiently restricted, so the server could be made to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17357 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network services due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17307 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17399 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server. CWE: CWE-434: Unrestricted Upload of File with Dangerous Type CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17394 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information. CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17411 DESCRIPTION: IBM API Connect could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) CVEID: CVE-2026-17140 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 3.3 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17386 DESCRIPTION: IBM API Connect could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator. CWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CVSS Source: IBM CVSS Base score: 8.1 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-18689 DESCRIPTION: IBM API Connect could allow an authenticated user to obtain limited information other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations. CWE: CWE-863: Incorrect Authorization CVSS Source: 4.3 CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-16714 DESCRIPTION: IBM API Connect could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 7.5 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17395 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16716 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment. CWE: CWE-1259: Improper Restriction of Security Token Assignment CVSS Source: IBM CVSS Base score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17146 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17428 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17280 DESCRIPTION: IBM API Connect could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts. CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts CVSS Source: IBM CVSS Base score: 8.9 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) CVEID: CVE-2026-17064 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17380 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17301 DESCRIPTION: IBM API Connect could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature. CWE: CWE-347: Improper Verification of Cryptographic Signature CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-16709 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 8.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17292 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 9.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) CVEID: CVE-2026-17139 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17389 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data. CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17376 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17383 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-108178 DESCRIPTION: IBM API Connect could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for. CWE: CWE-358: Improperly Implemented Security Check for Standard CVSS Source: IBM CVSS Base score: 4.2 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17172 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. CWE: CWE-290: Authentication Bypass by Spoofing CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17402 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host. CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17289 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17385 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17401 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. CWE: CWE-121: Stack-based Buffer Overflow CVSS Source: IBM CVSS Base score: 7.2 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17297 DESCRIPTION: IBM API Connect could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. CWE: CWE-601: URL Redirection to Untrusted Site CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17281 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-18836 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17379 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures. CWE: CWE-347: Improper Verification of Cryptographic Signature CVSS Source: IBM CVSS Base score: 7.4 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17279 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable. CWE: CWE-400: Uncontrolled Resource Consumption CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) CVEID: CVE-2026-17393 DESCRIPTION: IBM API Connect could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator. CWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CVSS Source: IBM CVSS Base score: 5.1 CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17333 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 8 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17114 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information. CWE: CWE-209: Generation of Error Message Containing Sensitive Information CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) CVEID: CVE-2026-19124 DESCRIPTION: IBM API Connect could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained. CWE: CWE-798: Use of Hard-coded Credentials CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17410 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17117 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution. CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17378 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-16912 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17388 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17404 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-16711 DESCRIPTION: IBM API Connect could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests. CWE: CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2026-16679 DESCRIPTION: IBM API Connect could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17374 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-16718 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17370 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17225 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented. CWE: CWE-235: Improper Handling of Extra Parameters CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17326 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. CWE: CWE-287: Improper Authentication CVSS Source: IBM CVSS Base score: 8.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17396 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17342 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17098 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to verbose error messages. CWE: CWE-209: Generation of Error Message Containing Sensitive Information CVSS Source: IBM CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17392 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant. CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17408 DESCRIPTION: IBM API Connect could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command. CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command CVSS Source: IBM CVSS Base score: 9.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVEID: CVE-2026-17375 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17400 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17062 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server. CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command CVSS Source: IBM CVSS Base score: 2.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2026-17390 DESCRIPTION: IBM API Connect could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session. CWE: CWE-79: Improper Neutralization of Input During Web Page Generation CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17367 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. CWE: CWE-522: Insufficiently Protected Credentials CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17241 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17298 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17214 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass security restrictions due to LDAP injection. CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query CVSS Source: IBM CVSS Base score: 4.8 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17398 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17285 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17067 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network resources due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17296 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 9.6 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17409 DESCRIPTION: IBM API Connect could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached. CWE: CWE-178: Improper Handling of Case Sensitivity CVSS Source: IBM CVSS Base score: 9.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) CVEID: CVE-2026-17368 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17318 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-19126 DESCRIPTION: IBM API Connect uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. CWE: CWE-916: Use of Password Hash With Insufficient Computational Effort CVSS Source: IBM CVSS Base score: 5.9 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) CVEID: CVE-2026-17381 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17232 DESCRIPTION: IBM API Connect could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17366 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17230 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) CVEID: CVE-2026-17288 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17305 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 5.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17373 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. CWE: CWE-863: Incorrect Authorization CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17237 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17291 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location. CWE: CWE-601: URL Redirection to Untrusted Site CVSS Source: IBM CVSS Base score: 8.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) CVEID: CVE-2026-17282 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17284 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.1 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17147 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17144 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2026-17382 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17387 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17236 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17345 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-16712 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked against the user's permissions, which could allow access to data belonging to other tenants. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17391 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 6.3 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17372 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17150 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant. CWE: CWE-184: Incomplete List of Disallowed Inputs CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17085 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent. CWE: CWE-178: Improper Handling of Case Sensitivity CVSS Source: IBM CVSS Base score: 4.1 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) CVEID: CVE-2026-17238 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-17371 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17293 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17211 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable. CWE: CWE-704: Incorrect Type Conversion or Cast CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) CVEID: CVE-2026-17363 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17322 DESCRIPTION: IBM API Connect could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files. CWE: CWE-532: Insertion of Sensitive Information into Log File CVSS Source: IBM CVSS Base score: 7.1 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17290 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts. CWE: CWE-290: Authentication Bypass by Spoofing CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) CVEID: CVE-2026-17406 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17369 DESCRIPTION: IBM API Connect could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker. CWE: CWE-352: Cross-Site Request Forgery CVSS Source: IBM CVSS Base score: 5.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) CVEID: CVE-2026-17377 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs. CWE: CWE-117: Improper Output Neutralization for Logs CVSS Source: IBM CVSS Base score: 5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) CVEID: CVE-2026-19129 DESCRIPTION: IBM API Connect could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted. CWE: CWE-295: Improper Certificate Validation CVSS Source: IBM CVSS Base score: 6.8 CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CVEID: CVE-2026-17397 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17112 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17294 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17403 DESCRIPTION: IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials. CWE: CWE-798: Use of Hard-coded Credentials CVSS Source: IBM CVSS Base score: 9 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17359 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution. CWE: CWE-94: Improper Control of Generation of Code CVSS Source: IBM CVSS Base score: 9.9 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17287 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) CVEID: CVE-2026-17407 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run. CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command CVSS Source: IBM CVSS Base score: 8.5 CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) CVEID: CVE-2026-17303 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to internal systems. CWE: CWE-918: Server-Side Request Forgery CVSS Source: IBM CVSS Base score: 6.4 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) CVEID: CVE-2026-16715 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization. CWE: CWE-639: Authorization Bypass Through User-Controlled Key CVSS Source: IBM CVSS Base score: 7.7 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) CVEID: CVE-2026-17231 DESCRIPTION: IBM API Connect could allow a remote attacker to obtain sensitive information due to an observable response discrepancy. CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVSS Source: IBM CVSS Base score: 5.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) CVEID: CVE-2026-17143 DESCRIPTION: IBM API Connect could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input. CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page CVSS Source: IBM CVSS Base score: 4.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) CVEID: CVE-2026-17190 DESCRIPTI...