An XML external entity (XXE) injection flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote, unauthenticated attacker obtain sensitive information.
What Is It
CVE-2026-16884 is an XML external entity (XXE) injection vulnerability in IBM API Connect. It is classified as CWE-611 (Improper Restriction of XML External Entity Reference). IBM's description says the flaw "could allow a remote attacker to obtain sensitive information."
IBM's PSIRT published the record to NVD on 2026-11-07. NVD lists its status as "Awaiting Analysis," so NVD has not yet added its own scoring or enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.9 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L. The vector means:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- Scope changed, so the impact can reach beyond the vulnerable component
- High confidentiality impact, with low integrity and availability impact
The exploitability subscore is 3.9 and the impact subscore is 5.3.
API Connect is an API management platform, so it often sits at the network edge. A pre-auth flaw that leaks data there deserves prompt attention.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The CPE entries in the record cover API Connect 12.1.0.0 and 12.1.1.2. The version data marks every release from 12.1.0.0 up to and including 12.1.1.2 as affected.
Patch Status
The supplied data does not name a fixed version or specific remediation steps. There is also no CISA KEV required action or due date, because the CVE is not in the KEV catalog.
IBM's advisory, linked below, is the authoritative source for fixed releases and remediation guidance. Organizations running API Connect 12.1.0.0 through 12.1.1.2 should:
- Review that advisory now.
- Inventory affected deployments.
- Prioritize any internet-facing instances, given the critical severity and the lack of an authentication requirement.