CVE-2026-17329 is a critical (CVSS 9.3) flaw in IBM API Connect 12.1.0.0 through 12.1.1.2: because the product does not properly validate endpoint URLs, a remote attacker with no authentication could obtain sensitive information.
What Is It
IBM's PSIRT disclosed CVE-2026-17329, and NVD published it on November 7, 2026. IBM describes it this way: API Connect "could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs." The weakness is CWE-918, Server-Side Request Forgery (SSRF).
NVD lists the record as "Awaiting Analysis." That means NVD has not yet scored it independently. All scoring and affected-version data below come from IBM as the CNA.
Why It Matters
IBM gave the flaw a CVSS v3.1 base score of 9.3 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. In plain terms:
- Network-reachable and low complexity
- No privileges and no user interaction needed
- Scope changed: the impact can reach resources beyond the vulnerable component
- High confidentiality impact, low integrity impact, no availability impact
The exploitability subscore is 3.9 and the impact subscore is 4.7. An attacker needs no credentials to reach the bug, and the scope-change rating means data outside API Connect itself may be at risk. That combination makes this a high-priority patch for any internet-facing API management deployment.
Exploitation status: The CVE has no CISA Known Exploited Vulnerabilities (KEV) entry as of publication. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The CPE entries for this record name versions 12.1.0.0 and 12.1.1.2. The version range shows that every release between them is also affected.
Patch Status
IBM has published a security bulletin for this vulnerability (linked below). The supplied NVD record does not give a fixed version or specific remediation steps. Administrators running API Connect 12.1.0.0–12.1.1.2 should read IBM's bulletin for the fix or mitigation guidance and apply it promptly, especially on internet-facing instances.
There is no CISA KEV entry, so no federal required action or due date applies right now.