CVE-2026-17353 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect 12.1.0.0 through 12.1.1.2 that could let a remote authenticated attacker obtain sensitive information and bypass security restrictions.
What Is It
CVE-2026-17353 is a server-side request forgery weakness (CWE-918) in IBM API Connect. IBM's description says a remote authenticated attacker could use it to obtain sensitive information and bypass security restrictions.
IBM PSIRT ([email protected]) published the record to NVD on 2026-11-07. Its NVD status is currently "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.6 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. In practical terms:
- Network-reachable: attackers can exploit it remotely, and attack complexity is low.
- Low privileges required: an attacker needs an account, but only a low-privileged one, and no user interaction is needed.
- Changed scope: exploitation can affect resources beyond the vulnerable component itself, which fits SSRF being used to reach systems the server can see.
- High confidentiality and integrity impact, with no availability impact.
API Connect usually sits between API consumers and backend services. An SSRF in a component in that position could expose internal resources that are not meant to be reachable from outside.
Exploitation status: CVE-2026-17353 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
Any deployment running a release in that range should be treated as affected.
Patch Status
The supplied NVD record does not name a fixed version and does not give specific remediation steps. IBM's security bulletin, linked from the record, is the authoritative source for fixes, upgrade paths and any workarounds.
Because the flaw is not in KEV, there is no CISA-mandated required action or due date. Given the critical score and the low privileges needed to exploit it, organizations running API Connect 12.1.0.0–12.1.1.2 should:
- review IBM's bulletin;
- apply the remediation IBM provides;
- check which authenticated users can reach API Connect while they work toward the fix.