CVE-2026-17336 is a critical SQL injection vulnerability in IBM API Connect 12.1.0.0 through 12.1.1.2 that could let a remote authenticated attacker execute arbitrary SQL commands.
What Is It
CVE-2026-17336 is an SQL injection flaw (CWE-89, improper neutralization of special elements used in an SQL command) in IBM API Connect. IBM's PSIRT reported it, and NVD published it on 2026-11-07. According to the vendor description, a remote authenticated attacker could exploit the flaw to execute arbitrary SQL commands.
The NVD record currently shows the status "Awaiting Analysis," so NVD has not yet added its own enrichment. The metrics below come from IBM as the CNA.
Why It Matters
IBM gives the issue a CVSS v3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practical terms:
- Network-reachable: the attacker does not need local access.
- Low complexity: no special conditions are required.
- Low privileges: any authenticated account is enough, not just an administrator's.
- No user interaction: the attacker does not need to trick anyone.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact to confidentiality, integrity and availability.
The low privilege requirement is what makes this serious. Any valid low-privilege account, including a compromised one, could be enough to run SQL against the backing data store. API Connect is an API management platform, so a successful attack could expose or change sensitive configuration and data.
Exploitation status: CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE in the supplied data, so KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
The listed CPEs are cpe:2.3:a:ibm:api_connect:12.1.0.0 and cpe:2.3:a:ibm:api_connect:12.1.1.2. The supplied data does not cover versions outside this range.
Patch Status
The supplied records do not name a fixed version or a specific workaround. IBM has published a security bulletin for this issue, linked below. Administrators running API Connect 12.1.0.0 through 12.1.1.2 should read that bulletin for IBM's remediation guidance and apply it as a priority.
There is no KEV entry, so CISA has set no required action or remediation due date for federal agencies.
Until remediation is applied, organizations should check who holds authenticated access to affected API Connect deployments, since the attack requires only low-privilege credentials.