A critical missing-authorization flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote authenticated attacker read, modify, or delete data that belongs to other tenants.
What Is It
CVE-2026-17066 is a missing authorization weakness (CWE-862) in IBM API Connect. IBM's PSIRT reported it, and NVD published it on 2026-11-07. According to the description, a remote authenticated attacker could use it to "obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization."
NVD lists the record as "Awaiting Analysis." It has not done its own analysis yet, so the scoring below comes from IBM as the CNA.
Why It Matters
IBM rates the flaw CVSS 3.1 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network attack vector, low complexity, no user interaction. The flaw can be exploited remotely with no special conditions.
- High privileges required. The attacker must already hold a privileged authenticated account. This is why the exploitability subscore is only 2.3.
- Changed scope. The impact reaches beyond the attacker's own security boundary, which matches the cross-tenant exposure in the description.
- High impact on confidentiality, integrity, and availability. Other tenants' data can be exposed, altered, or deleted.
In multi-tenant API management, tenant isolation is a core security guarantee. A missing authorization check that lets one tenant reach another tenant's data breaks that guarantee directly.
Exploitation status: CVE-2026-17066 is not in the supplied CISA KEV data. KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
NVD's CPE entries for the affected range are cpe:2.3:a:ibm:api_connect:12.1.0.0 and cpe:2.3:a:ibm:api_connect:12.1.1.2.
Patch Status
The source data does not name a fixed version or give specific remediation steps. IBM has published a support page for this issue, linked below. Organizations running API Connect 12.1.0.0 through 12.1.1.2 should check that advisory for the vendor's fix or mitigation guidance.
CISA has not issued a KEV required action or due date, because the CVE is not currently in the KEV catalog.
While the fix is being applied, defenders should review who holds high-privilege accounts on affected deployments. The CVSS vector shows that an attacker needs those privileges to exploit the flaw.
Sources
- NVD: CVE-2026-17066
- IBM Support: Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-17066 not listed at time of writing)