CVE-2026-17146 is a critical (CVSS 9.9) improper input validation flaw in IBM API Connect that could let a remote authenticated attacker execute arbitrary JavaScript and obtain sensitive information.
What Is It
CVE-2026-17146 is a vulnerability in IBM API Connect, disclosed by IBM PSIRT and published to NVD on November 7, 2026. IBM's description says affected versions "could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation."
The weakness is classified as CWE-79, Improper Neutralization of Input During Web Page Generation (cross-site scripting). The NVD record is still marked "Awaiting Analysis," so NIST has not yet published its own assessment.
Why It Matters
IBM rates the flaw 9.9 CRITICAL under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). That vector means:
- Network-reachable with low attack complexity
- Low privileges needed: any authenticated user may be enough
- No user interaction required
- Scope changed: the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity and availability
API Connect sits in front of an organization's APIs, so an attacker who can run arbitrary JavaScript there could get at sensitive information handled by the platform. Because only low-privileged authentication is required, any environment with many users or broad portal access is at greater risk.
Exploitation status: The supplied CISA KEV data contains no entry for CVE-2026-17146, so KEV does not currently confirm active exploitation. This could change, and defenders should watch the CISA KEV catalog.
What's Vulnerable
According to IBM's CNA data, the following IBM API Connect versions are affected:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
Patch Status
IBM has published two security bulletins for this CVE (linked below). The supplied NVD record does not list fixed version numbers or a specific remediation. Administrators should:
- Check the IBM bulletins for fixed releases and any interim fixes or workarounds
- Find any API Connect deployments running 10.0.8.0–10.0.8.12 or 12.1.0.0–12.1.1.2
- Patch quickly, given the critical score and low barrier to exploitation
There is no CISA KEV entry, so no federal required action or due date applies at this time.