IBM API Connect 12.1.0.0 through 12.1.1.2 has a critical (CVSS 9.8) improper authentication flaw that could let a remote attacker without credentials pose as a trusted party and access sensitive API catalog and runtime configuration data.
What Is It
CVE-2026-17278 is an improper authentication vulnerability in IBM API Connect. IBM's description says the product does not properly verify information supplied by the client. A caller could exploit this to appear as a trusted party and get unauthorized access to sensitive API catalog and runtime configuration data.
The weakness is classified as CWE-290 (Authentication Bypass by Spoofing). IBM PSIRT ([email protected]) reported the CVE, and NVD published it on 2026-11-07. NVD lists its status as "Awaiting Analysis," so NVD has not yet reviewed the record on its own.
Why It Matters
IBM gives this flaw a CVSS v3.1 base score of 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction: an attacker needs no account and no victim action.
- High impact on confidentiality, integrity and availability
API Connect is an API management platform, so its catalog and runtime configuration data can reveal how an organization's APIs are built and exposed. A spoofing-based authentication bypass that needs no credentials makes this a high-priority fix for any internet-facing deployment.
Exploitation status: CISA's Known Exploited Vulnerabilities (KEV) catalog does not list this CVE. The supplied data does not confirm active exploitation.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | API Connect | 12.1.0.0 through 12.1.1.2 (inclusive) |
The CPEs in the record include:
- cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
Patch Status
The supplied NVD record does not name a fixed version. IBM has published a security bulletin for this CVE, and administrators should use it as the authoritative source for remediation steps and fixed releases. Because no CISA KEV entry exists, there is no federal required action or due date for this CVE.
Recommended steps: - Check whether you run API Connect 12.1.0.0 through 12.1.1.2. - Follow the remediation guidance in IBM's bulletin as soon as you can. - Treat any instance that is exposed to the network and still unpatched as high priority.
Sources
- NVD, CVE-2026-17278
- IBM Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)