A critical SQL injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 could let a remote authenticated attacker execute arbitrary SQL commands.
What Is It
CVE-2026-17134 is a SQL injection vulnerability (CWE-89) in IBM API Connect. According to the NVD record, which was sourced from IBM PSIRT, a remote authenticated attacker could exploit the flaw to execute arbitrary SQL commands. NVD published the record on 2026-11-07, and its status is currently "Awaiting Analysis."
Why It Matters
IBM gives this flaw a CVSS v3.1 base score of 9.9 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. In practical terms, the vector means:
- Network-reachable: the attacker does not need local access.
- Low attack complexity: no special conditions are required to exploit it.
- Low privileges required: an attacker only needs an authenticated account with basic access, not an administrator account.
- No user interaction: no victim has to click or open anything.
- Scope changed: the impact can extend beyond the vulnerable component.
- High confidentiality and integrity impact, low availability impact.
API Connect is an API management platform, so a successful attack against its backing database could expose or alter sensitive data. The low privilege requirement makes compromised or low-tier accounts a realistic route to exploitation.
The supplied data contains no CISA Known Exploited Vulnerabilities (KEV) entry for CVE-2026-17134. As of this writing, KEV does not confirm active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
Organizations running any API Connect release in this range should treat their deployment as affected.
Patch Status
The NVD record does not name a fixed version. IBM's security bulletin, linked below, is the authoritative source for remediation guidance and any available fix. Because no KEV entry exists, CISA has not set a required action or due date for this CVE.
Recommended steps:
- Review IBM's bulletin and apply the remediation it describes.
- Inventory all API Connect instances and confirm which versions they run.
- Until a fix is applied, review who holds authenticated access to API Connect, since exploitation requires low-privileged credentials.
Sources
- NVD, CVE-2026-17134
- IBM Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry found for this CVE)