CVE-2026-17296 is a server-side request forgery (SSRF) vulnerability in IBM API Connect that could let a remote authenticated attacker obtain sensitive information, and IBM's PSIRT scores it 9.6 (Critical).
What Is It
CVE-2026-17296 is a server-side request forgery weakness (CWE-918) in IBM API Connect. According to the NVD record, which IBM's PSIRT ([email protected]) published on 2026-11-07, a remote authenticated attacker could use the flaw to obtain sensitive information.
NVD lists the record as "Awaiting Analysis." That means the details come from the vendor's submission, and NVD has not yet added its own assessment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.6 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. In practice:
- Network-reachable: the attacker does not need local access.
- Low attack complexity: no special conditions are required.
- Low privileges: the attacker needs an account, but only a low-privileged one.
- No user interaction: no victim has to take any action.
- Changed scope: the impact can reach beyond the vulnerable component itself.
- High impact on confidentiality and integrity, with no availability impact.
The changed scope is the key point for an SSRF in an API management platform. An attacker could use API Connect as a pivot to reach internal resources it can talk to. The CVSS vector also rates integrity impact as high, even though the written description mentions only information disclosure.
Exploitation status: the CISA Known Exploited Vulnerabilities (KEV) data supplied for this brief was empty. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
IBM lists these IBM API Connect versions as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running either release line within these ranges should treat their deployments as exposed. This is especially urgent where low-privileged accounts exist or where API Connect has network access to sensitive internal systems.
Patch Status
The NVD record does not name fixed versions or specific remediation steps. It links to two IBM support pages, which are the place to find IBM's official remediation guidance. CISA has issued no required action, because no KEV entry was present in the supplied data.
Until fixes are confirmed and applied, administrators should:
- review the IBM advisories below
- find any instances running the affected version ranges
- prioritize upgrading them, given the Critical rating