CVE-2026-16709

Summary

IBM API Connect contains a stored cross-site scripting (XSS) vulnerability where untrusted user input is not properly sanitized before being rendered in web pages, allowing an authenticated attacker to inject malicious JavaScript that executes in other users' browsers. This enables session hijacking, credential theft, or unauthorized actions on behalf of victims.

Exploitability

Exploitation requires a low-privilege authenticated user with access to the vulnerable input field and social engineering (e.g.,诱使 another user view the malicious page), as indicated by CVSS UI:R and PR:L.

Blast radius

If exploited, attackers could compromise any user who views the injected payload, including administrators, leading to full account takeover, data exfiltration, or manipulation of API management configurations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for this XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.