CVE-2026-17409 is a critical (CVSS 9.4) access-control flaw in IBM API Connect: inconsistent handling of case sensitivity lets a remote, unauthenticated attacker reach restricted administrative operations and obtain sensitive information.
What Is It
IBM's description says API Connect handles case sensitivity improperly. Access controls are not applied consistently to every variation of a request, so a differently formed request can reach operations that should be restricted. The weakness is classified as CWE-178 (Improper Handling of Case Sensitivity).
According to the advisory data, successful exploitation could let a remote attacker:
- Execute unauthorized administrative operations
- Obtain sensitive information
IBM PSIRT published the CVE on 2026-11-07. NVD lists it as "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
IBM PSIRT scored the flaw 9.4 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. That vector means:
- Network-reachable with low attack complexity
- No privileges and no user interaction required
- High integrity and availability impact, low confidentiality impact
API Connect is an API management platform. A gap that exposes administrative operations to unauthenticated network attackers matters most where the management plane can be reached from untrusted networks.
At the time of writing there is no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE. The supplied data does not confirm active exploitation.
What's Vulnerable
IBM lists the following IBM API Connect versions as affected:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
Organizations running any release in these ranges should treat their deployments as in scope.
Patch Status
IBM has published two support advisories for this vulnerability (linked below). The supplied NVD record does not name fixed versions or specific remediation steps. Administrators should:
- Review both IBM advisories for fixed releases, interim fixes, or mitigations
- Upgrade any instance running an affected version as soon as IBM's guidance allows
- Limit network exposure of API Connect management interfaces until patched
Because the CVE has no KEV listing, no CISA-mandated required action or due date applies at this time.