CVE-2026-17158

Summary

IBM API Connect contains an improper authentication flaw (CWE-287) that allows a remote authenticated attacker to gain elevated privileges within versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2.

Exploitability

Exploitation requires valid credentials (low privilege) and no user interaction; the attack is remote and straightforward once authenticated.

Blast radius

Successful exploitation grants elevated privileges, potentially enabling full compromise of API management functions, data exfiltration, or service disruption across connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.