CVE-2026-17313 is a critical (CVSS 9.8) authentication bypass in IBM API Connect 12.1.0.0 through 12.1.1.2. A remote attacker could use it to obtain sensitive information and take control of gateway configuration.
What Is It
IBM's description says this is an authentication bypass through an alternate path or channel, classed as CWE-288. Affected versions of IBM API Connect could let a remote attacker obtain sensitive information and take control of gateway configuration.
IBM PSIRT ([email protected]) reported the vulnerability. NVD published it on 2026-11-07, and the record is still in "Awaiting Analysis" status. That means the details here come from the vendor's submission, not from NVD's own enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector means:
- Network-reachable: no local access is needed.
- Low attack complexity
- No privileges required: the attacker does not need to be logged in.
- No user interaction: no victim has to click or do anything.
- High impact on confidentiality, integrity and availability.
API Connect sits in front of an organization's APIs, so gateway configuration controls how API traffic is exposed and governed. An unauthenticated attacker who takes control of that configuration could undermine the security controls the gateway enforces.
Exploitation status: the supplied CISA KEV data has no entry for this CVE, so KEV does not currently confirm active exploitation. Check the KEV catalog again, because a listing can come later.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
The CPE entries in the record cover API Connect 12.1.0.0 and 12.1.1.2. The version data treats every release in that range as affected.
Patch Status
The supplied NVD record does not name a fixed version or give remediation steps. IBM has published a support advisory for this issue (linked below), and it should be treated as the authoritative source for fixes, workarounds and upgrade paths.
There is no CISA KEV entry, so no federal required action or due date applies at this time.
Organizations running API Connect 12.1.0.0–12.1.1.2 should:
- Review the IBM advisory and apply the vendor's guidance as soon as possible.
- Given the unauthenticated, network-reachable attack path, prioritize systems whose management or gateway interfaces are reachable from untrusted networks.