CVE-2026-17410 is a critical (CVSS 9.9) argument-delimiter neutralization flaw in IBM API Connect that could allow a remote authenticated attacker to access and modify other tenants' portal data.
What Is It
CVE-2026-17410 is a vulnerability in IBM API Connect caused by improper neutralization of argument delimiters, classified as CWE-88 (Argument Injection). According to IBM's description, a remote authenticated attacker could exploit the flaw to access and modify portal data belonging to other tenants.
IBM's PSIRT published the record to NVD on November 7, 2026. NVD lists its status as "Awaiting Analysis," so NVD has not yet run its own enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.9 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Network-reachable, with low attack complexity
- Low privileges required and no user interaction
- Changed scope, which is consistent with the cross-tenant impact IBM describes: successful exploitation could affect resources beyond the attacker's own tenant
- High impact to confidentiality, integrity and availability
In multi-tenant API Connect deployments, any low-privileged authenticated user is a potential attacker. Based on IBM's description, successful exploitation could extend past that user's own account into other tenants' portal data.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
IBM lists these versions of IBM API Connect as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
The source data does not list other product lines or versions.
Patch Status
The source data does not name specific fixed versions. IBM has published two security bulletins for this CVE, and organizations running affected versions should check them for remediation guidance and fixed releases.
Since there is no KEV entry, no CISA-mandated required action or due date applies. Given the critical score and potential cross-tenant impact, operators of multi-tenant API Connect deployments should treat the IBM bulletins as a priority.