CVE-2026-17396 is a SQL injection vulnerability in IBM API Connect. IBM rates it CVSS 9.6 (Critical), and a remote attacker who is authenticated could use it to obtain sensitive information.
What Is It
CVE-2026-17396 is a SQL injection weakness (CWE-89) in IBM API Connect. The IBM PSIRT description says a remote attacker who is authenticated "could ... obtain sensitive information due to SQL injection." NVD published the record on 2026-11-07, and its status is still "Awaiting Analysis."
IBM's CVSS v3.1 assessment is:
- Base score: 9.6 (CRITICAL)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Exploitability score: 3.1
- Impact score: 5.8
Why It Matters
The vector describes a flaw that can be exploited over the network with low attack complexity. It needs only low privileges and no user interaction. The scope is marked Changed, which means the impact can reach beyond the vulnerable component. Confidentiality and integrity impacts are both rated High, and availability impact is None.
The text description mentions only information disclosure. The vector, however, also scores a high integrity impact. API Connect is an API management platform, so a successful attack could expose sensitive data handled by the deployment.
Exploitation status: CVE-2026-17396 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild, and no KEV remediation deadline applies.
What's Vulnerable
IBM lists these affected versions of IBM API Connect:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
The affected CPEs cover the boundary versions of each range:
cpe:2.3:a:ibm:api_connect:10.0.8.0cpe:2.3:a:ibm:api_connect:10.0.8.12cpe:2.3:a:ibm:api_connect:12.1.0.0cpe:2.3:a:ibm:api_connect:12.1.1.2
Patch Status
The NVD record does not list fixed versions or specific remediation steps. IBM has published two support pages for this issue, linked under Sources. If you run API Connect in either affected range, read those advisories for IBM's fix guidance and upgrade path.
There is no CISA KEV entry, so there is no federal required-action deadline. Even so, a 9.6 critical score with a network attack vector and low required privileges is a strong reason to patch quickly.