CVE-2026-17394 is a critical (CVSS 9.6) flaw in IBM API Connect: a remote attacker with a low-privilege account can change an access-related setting that only the system should control, which could expose sensitive information.
What Is It
IBM's description says API Connect does not properly control which object attributes a user can modify. An authenticated user can supply a value that changes an access-related setting meant to be set only by the system. That change can then expose sensitive information.
The weakness is CWE-915. IBM's PSIRT reported the issue, and NVD published it on 2026-11-07. NVD has not analyzed it yet; its status is "Awaiting Analysis."
Why It Matters
IBM's CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- Network-reachable and low complexity to exploit
- Needs only low privileges and no user interaction
- Scope changed: the impact can reach beyond the vulnerable component
- High impact to confidentiality and integrity, no impact to availability
API Connect is an API management platform, so access-control settings in it may govern more than the product itself. Any account with basic access is a possible starting point for this attack.
Exploitation status: this CVE has no CISA KEV entry, so KEV does not confirm active exploitation at this time. The supplied data does not report any public exploitation.
What's Vulnerable
IBM API Connect, in these version ranges:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
If you run API Connect on either branch, check your installed version against these ranges.
Patch Status
The supplied NVD record does not name fixed versions. CISA has published no KEV required action or remediation due date, because the CVE is not in the catalog. IBM has published two support bulletins for this issue (listed below). Administrators should:
- Use those bulletins to find the fix or mitigation for their release branch.
- Until they upgrade, review which accounts can log in to API Connect, since only low privileges are needed to exploit the flaw.