CVE-2026-17158 is a critical (CVSS 9.9) improper authentication flaw in IBM API Connect that could let a remote attacker with an authenticated account gain elevated privileges.
What Is It
IBM's PSIRT disclosed CVE-2026-17158, published to NVD on November 7, 2026. According to the advisory, IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 "could allow a remote authenticated attacker to gain elevated privileges due to improper authentication." The flaw is classified as CWE-287 (Improper Authentication).
NVD lists the record as "Awaiting Analysis," so the 9.9 score comes from IBM as the CNA, not from NVD's own assessment.
Why It Matters
IBM's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Network-exploitable with low attack complexity
- Requires only low privileges, so a low-privileged account is enough
- No user interaction needed
- Scope changed, so the impact can reach beyond the vulnerable component
- High impact to confidentiality, integrity, and availability
API Connect manages API exposure and access control, so a privilege escalation in it deserves attention. Any authenticated user in the environment could become a path to higher privileges.
The CISA KEV catalog has no entry for CVE-2026-17158, so active exploitation is not confirmed by KEV at this time. The supplied data also has no KEV-mandated remediation deadline.
What's Vulnerable
According to IBM's affected-version data:
| Product | Affected Versions |
|---|---|
| IBM API Connect | 10.0.8.0 through 10.0.8.12 |
| IBM API Connect | 12.1.0.0 through 12.1.1.2 |
Patch Status
The supplied NVD record does not name fixed versions or specific remediation steps. IBM has published two support pages for this vulnerability (linked below), and they are the authoritative source for fixes and mitigations. Administrators running affected 10.0.8.x or 12.1.x releases should:
- Check IBM's advisories for the fixed releases and apply them.
- Until patched, review which accounts can authenticate to API Connect, because the attack needs only low-privileged access.
- Watch the CISA KEV catalog in case exploitation status changes.