A critical LDAP injection vulnerability (CVSS 9.9) in IBM API Connect could let a remote authenticated attacker gain unauthorized administrative access to other tenants.
What Is It
CVE-2026-17392 is an LDAP injection vulnerability (CWE-90) in IBM API Connect. According to IBM's description, user-supplied input is not properly neutralized before it is used in directory queries. An attacker can craft input that changes the LDAP query. That can grant access beyond the attacker's own tenant, including unauthorized administrative access to other tenants.
IBM PSIRT assigned a CVSS v3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. NVD published the record on 2026-11-07, and its status is still "Awaiting Analysis."
Why It Matters
The CVSS vector describes a flaw that is easy to exploit and has a severe impact:
- Network attack vector, low complexity: the attacker can reach it remotely with no special conditions.
- Low privileges required, no user interaction: according to the CVSS vector, an attacker needs only a low-privileged authenticated account. That potentially puts authenticated users in scope, though the exact roles and access paths involved have not been publicly detailed.
- Scope changed: the impact reaches beyond the vulnerable component, in this case across tenant boundaries.
- High confidentiality, integrity, and availability impact.
In a multi-tenant API management platform, breaking tenant isolation is a serious failure. A low-privileged account in one tenant could become an administrator over other tenants' API configurations and data.
Exploitation status: As of publication, CVE-2026-17392 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
IBM lists these affected versions of IBM API Connect:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Any deployment running a version in either range should be treated as affected. The risk is highest in environments where multiple tenants or organizations share one API Connect instance.
Patch Status
IBM has published two security support pages for this vulnerability, linked below. The supplied NVD record does not name fixed versions or specific remediation steps. Administrators should check the IBM advisories for the fixed releases and any interim mitigations, and apply them as soon as possible.
There is no CISA KEV required action or remediation deadline, because the vulnerability is not currently listed in the KEV catalog.
Until a fix is applied, it is worth reviewing which authenticated accounts exist on affected instances. Based on the low-privilege requirement in the CVSS vector, an authenticated account may be enough to meet the precondition for exploitation. IBM has not specified which roles or configurations are exposed.