CVE-2026-17301 is a critical (CVSS 9.8) authentication bypass in IBM API Connect: the product does not properly verify a cryptographic signature, so an unauthenticated attacker can get past authentication over the network.
What Is It
IBM disclosed CVE-2026-17301 through its PSIRT, and NVD published it on November 7, 2026. The flaw is classified as CWE-347 (Improper Verification of Cryptographic Signature). According to the advisory, the weakness "could allow an unauthenticated attacker to bypass authentication." NVD lists the record as "Awaiting Analysis," so the scoring below comes from IBM as the CVE source rather than from NVD's own review.
Why It Matters
IBM rates this a 9.8 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network-reachable: the attacker does not need local access.
- Low complexity: no special conditions are needed to exploit it.
- No privileges or user interaction: the attacker needs no credentials, and no one has to click anything.
- High impact: confidentiality, integrity and availability are all affected.
API Connect is an API management platform, so getting past its authentication could expose the systems and data behind it. At the time of writing, CVE-2026-17301 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. That may change, so check the catalog for updates. Because of the severity and the unauthenticated network attack path, patch this quickly anyway.
What's Vulnerable
IBM lists these IBM API Connect versions as affected:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
If you run any version in these ranges, assume you are exposed until you confirm otherwise with IBM's guidance.
Patch Status
The source data does not name fixed versions or describe specific remediation steps. IBM has published two support bulletins tied to this CVE, linked below. Administrators should:
- Check which API Connect versions they have deployed against the affected ranges above.
- Read both IBM bulletins for fixed releases, interim fixes or mitigations, and apply them.
- Put internet-facing API Connect deployments first, since the flaw needs no authentication.
Because the CVE is not currently listed in the CISA KEV catalog, no federal "required action" or due date applies yet.