CVE-2026-16884

Summary

IBM API Connect contains an XML external entity (XXE) vulnerability in versions 12.1.0.0 through 12.1.1.2, allowing unauthenticated remote attackers to read sensitive server-side files or cause denial of service by injecting malicious XML content.

Exploitability

Exploitation is straightforward for remote attackers with network access to the affected API Connect endpoints that parse XML input without disabling external entity resolution.

Blast radius

Successful exploitation could lead to full compromise of confidentiality via file disclosure, partial integrity loss through potential SSRF or command injection if the XML parser interacts with other subsystems, and availability impact via XML bomb attacks.

Detection

Defenders should monitor for unusually large or complex XML payloads in HTTP requests to API Connect endpoints, especially those containing DOCTYPE declarations with external entity references (e.g., <!ENTITY ... SYSTEM

Prioritized remediation

Upgrade IBM API Connect to version 12.1.1.3 or later, which contains the vendor's official fix for CVE-2026-16884.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.