CVE-2026-17172

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain an improper authentication flaw (CWE-290) where client-supplied information is insufficiently verified, allowing an authenticated attacker to bypass security restrictions and impersonate another user or service.

Exploitability

Exploitation requires a valid authenticated session (PR:L) and high skill due to the high attack complexity (AC:H), with no public exploit available.

Blast radius

Successful exploitation could lead to unauthorized access to protected APIs, data exfiltration, or privilege escalation within the API management platform, affecting confidentiality, integrity, and availability of downstream services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, as these versions contain the fix for CVE-2026-17172.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.