IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection flaw (CVE-2026-17132) that could let a remote authenticated attacker execute arbitrary SQL commands.
What Is It
CVE-2026-17132 is a SQL injection vulnerability (CWE-89) in IBM API Connect. IBM's PSIRT reported it, and NVD published it on 2026-11-07. According to the description, the product does not properly neutralize special elements used in an SQL command. That could allow a remote authenticated attacker to execute arbitrary SQL commands.
NVD lists the record as "Awaiting Analysis." The severity data below comes from IBM's CVSS v3.1 assessment, the primary score for this record.
Why It Matters
IBM rates this flaw 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- Low privileges required: the attacker needs to be authenticated, but only with low-level access.
- No user interaction: no victim has to take any action.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High impact to confidentiality, integrity and availability.
API Connect is an API management platform, so arbitrary SQL execution against its backend could expose or change the data it manages. The low privilege requirement and the changed scope are why the score is so high.
Exploitation status: No CISA KEV entry was supplied for this CVE, so the supplied data does not confirm active exploitation. Check the KEV catalog for updates.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
The affected-version data in the NVD record specifically lists the CPEs for 12.1.0.0 and 12.1.1.2. The full range runs from 12.1.0.0 up to and including 12.1.1.2.
Patch Status
The supplied NVD record does not name a fixed version or specific remediation steps. IBM's security bulletin, linked below, is the reference for this CVE. Organizations running API Connect 12.1.0.0 through 12.1.1.2 should:
- Read IBM's advisory for fix availability and upgrade guidance.
- Prioritize remediation given the critical severity.
- Review which authenticated accounts can reach API Connect, because exploitation requires only low privileges.
No CISA KEV required action or due date applies, since no KEV entry was supplied.