CVE-2026-17132

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a SQL injection vulnerability (CWE-89) that allows an authenticated remote attacker to execute arbitrary SQL commands due to improper neutralization of special characters in SQL queries.

Exploitability

Exploitation requires valid authentication credentials and knowledge of vulnerable input points, but otherwise has low barriers due to the direct SQL injection vector.

Blast radius

Successful exploitation could lead to full compromise of the underlying database, including unauthorized access to sensitive data, modification or deletion of records, and potential lateral movement within connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, as this version includes the fix for CVE-2026-17132.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.