IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that could let a remote, unauthenticated attacker take full administrative control.
What Is It
CVE-2026-17360 is a critical vulnerability in IBM API Connect. It was published to the National Vulnerability Database (NVD) on November 7, 2026, and IBM's Product Security Incident Response Team (PSIRT) is the source of the record. IBM's description says the product "could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials." The weakness is classified as CWE-798 (Use of Hard-coded Credentials).
The NVD status is "Awaiting Analysis," so NVD has not yet added its own enrichment. The details below come from IBM's submission.
Why It Matters
IBM rates the flaw CVSS 3.1 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction required: the attacker does not need an account, and no user has to click anything.
- High impact on confidentiality, integrity, and availability.
API Connect is an API management platform, so full administrative control of it is a high-value foothold. The supplied CISA Known Exploited Vulnerabilities (KEV) entry is empty. This CVE is not currently listed in the KEV catalog, and the supplied data does not confirm active exploitation. Because the credentials are hard-coded, every deployment of an affected version probably shares the same exposure, so administrators should treat it as a priority.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
The CPE (Common Platform Enumeration) entries list 12.1.0.0 and 12.1.1.2. The version range covers every release between them.
Patch Status
The supplied records do not name a fixed version or specific remediation steps. IBM has published a security bulletin for this issue, linked below. Administrators running API Connect 12.1.0.0–12.1.1.2 should check that bulletin for the vendor's fix and upgrade guidance and apply it promptly. There is no KEV entry, so no CISA-mandated remediation due date applies at this time.
Sources
- NVD, CVE-2026-17360
- IBM Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)