CVE-2026-17338 is a critical (CVSS 9.1) broken object-level authorization flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 that could let a remote, authenticated attacker obtain sensitive information.
What Is It
CVE-2026-17338 is an authorization weakness in IBM API Connect. IBM's description says the product "could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization." The weakness is classified as CWE-639.
IBM's PSIRT published the record on 2026-11-07. It currently shows as "Awaiting Analysis" in NVD, so NVD has not added its own enrichment yet.
Why It Matters
IBM rates the flaw 9.1 (CRITICAL) under CVSS v3.1, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. The main points from that score:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: it needs no special conditions.
- Low privileges: any authenticated account is enough, so admin rights are not required.
- No user interaction: no one else has to click or approve anything.
- Scope changed: the impact can reach resources beyond the vulnerable component.
- High confidentiality impact, with low integrity and availability impact.
API Connect is an API management platform, so a data exposure flaw here may matter a lot in environments that rely on it. The low bar of "authenticated with low privileges" makes insider abuse or a single compromised account a realistic path to exploitation.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. That means KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
The affected CPEs listed are cpe:2.3:a:ibm:api_connect:12.1.0.0 and cpe:2.3:a:ibm:api_connect:12.1.1.2. The version range in the record covers everything between them.
Patch Status
The source data does not list fixed versions or specific remediation steps. Because there is no KEV entry, CISA has not issued a required action or due date.
IBM's security bulletin, linked below, is the authoritative reference for remediation guidance. Organizations running API Connect 12.1.0.0 through 12.1.1.2 should:
- check that bulletin for fixed releases or mitigations
- treat this as a priority given the CRITICAL rating
Sources
- IBM Security Bulletin (node 7295635)
- NVD – CVE-2026-17338
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)