IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a critical server-side request forgery (SSRF) flaw that could let a remote attacker reach internal network resources.
What Is It
CVE-2026-16918 is a server-side request forgery vulnerability (CWE-918) in IBM API Connect. According to the NVD record, which uses IBM PSIRT's description, the flaw "could allow a remote attacker to access internal network resources due to server-side request forgery."
IBM PSIRT gave it a CVSS v3.1 base score of 9.3 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. NVD published the record on 2026-11-07. Its status is still "Awaiting Analysis," so NVD has not yet scored it independently.
Why It Matters
The CVSS vector describes a flaw that is easy to reach and serious if exploited:
- Network attack vector, low complexity: An attacker can exploit it remotely without special conditions.
- No privileges or user interaction required: An unauthenticated attacker can trigger it.
- Scope changed: The impact reaches beyond the vulnerable component, into the internal resources that API Connect can access.
- High confidentiality impact, low integrity impact: The main risk is exposure of data from internal systems.
API Connect is an API management platform, so it often sits at the edge between external clients and internal services. An SSRF flaw in that position could let an attacker use it as a pivot into network segments they could not otherwise reach.
Exploitation status: CVE-2026-16918 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
According to IBM PSIRT's affected-product data:
| Product | Affected Versions |
|---|---|
| IBM API Connect | 10.0.8.0 through 10.0.8.12 |
| IBM API Connect | 12.1.0.0 through 12.1.1.2 |
Patch Status
IBM has published two support advisories for this vulnerability (linked below). The supplied NVD data does not list fixed version numbers, and there is no CISA required action because the CVE is not in KEV.
Organizations running affected API Connect versions should:
- Review IBM's advisories for fixed releases and remediation guidance.
- Prioritize patching, given the critical score and the fact that no authentication is needed.
- Check which internal resources API Connect deployments can reach on the network.