IBM API Connect versions 12.1.0.0 through 12.1.1.2 have a critical confused deputy vulnerability that could let a remote authenticated attacker bypass security restrictions.
What Is It
CVE-2026-16920 is a confused deputy vulnerability in IBM API Connect. IBM's PSIRT reported it, and NVD published it on 2026-11-07. According to the NVD description, the flaw "could allow a remote authenticated attacker to bypass security restrictions." It is classified as CWE-441 (Unintended Proxy or Intermediary, "Confused Deputy"). In this class of bug, an attacker gets a more privileged component to act for them.
NVD lists the record as "Awaiting Analysis," so NVD has not yet added its own enrichment. The available details come from IBM's submission.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable (AV:N), with low attack complexity (AC:L)
- Low privileges required (PR:L): any authenticated account may be enough
- No user interaction (UI:N)
- Scope changed (S:C): the impact can reach beyond the vulnerable component
- High impact on confidentiality, integrity and availability
API Connect is an API management platform, so it often sits in front of other services. A flaw that lets a low-privileged user get around security restrictions there deserves urgent attention.
Exploitation status: No CISA KEV entry was supplied for this CVE, so CISA has not confirmed active exploitation as of this writing. Teams should still treat it as high priority given the score and the low bar for attack.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
Listed CPEs:
- cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Patch Status
The source data does not name a fixed version or any specific remediation steps. IBM has published a support advisory for this issue, linked below. Administrators running API Connect 12.1.0.0 through 12.1.1.2 should check that advisory for fixed releases or mitigation guidance and apply it as soon as they can.
There is no KEV entry, so no CISA-mandated required action or due date applies at this time.
Sources
- NVD: CVE-2026-16920
- IBM Security Bulletin (Support Page 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)