CVE-2026-17292 is a critical (CVSS 9.1) broken object-level authorization flaw in IBM API Connect. According to IBM, it could allow a remote authenticated attacker to take ownership of organizations they do not control.
What Is It
CVE-2026-17292 is a broken object-level authorization vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) in IBM API Connect. IBM's description says access checks on organization objects are incomplete. As a result, an authenticated user may be able to change the ownership of organizations they do not control.
IBM PSIRT gave it a CVSS v3.1 base score of 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. Based on that vector, the flaw is rated as reachable over the network with low attack complexity. It is rated as needing only low-privileged credentials and no user interaction.
Why It Matters
API Connect is IBM's platform for managing APIs, and organizations are its ownership boundaries. An attacker who could reassign an organization's owner might be able to take control of resources that belong to other tenants or teams. The scope is rated as changed (S:C), which indicates the impact could extend beyond the vulnerable component. The integrity impact is rated High, and confidentiality and availability impacts are rated Low. These ratings come from the CVSS assessment, not from observed attacks, and the real-world impact may depend on how each deployment is configured.
Exploitation would require a valid account, though the CVSS rating indicates a low-privileged one may be enough. Depending on the deployment, an authenticated user, including a self-registered or compromised one, could potentially abuse this to extend their control across the platform.
Exploitation status: CVE-2026-17292 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied sources don't confirm active exploitation. NVD lists the record as "Awaiting Analysis," and it was published on November 7, 2026.
What's Vulnerable
According to the NVD record, these IBM API Connect versions are affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Patch Status
IBM PSIRT has published two support advisories for this vulnerability, linked below. The supplied NVD data doesn't name fixed versions or specific remediation steps. Administrators running affected versions should:
- Read the IBM advisories for fixed releases and remediation guidance, and apply them.
- Check organization ownership records for unexpected changes.
- Treat platforms where untrusted or self-registered users can log in as a higher priority.
No CISA KEV required action or due date applies, because the CVE isn't in the KEV catalog.