CVE-2026-17280

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 lack proper rate limiting on authentication endpoints, allowing unauthenticated attackers to repeatedly submit credential guesses without account lockout or delay mechanisms. This enables brute-force attacks to eventually discover valid credentials, violating the principle of excessive authentication attempt prevention.

Exploitability

Exploitation requires network access to the authentication endpoint and is hindered by high attack complexity (AC:H), meaning the attacker likely needs to overcome timing, obfuscation, or other non-trivial barriers before brute-forcing succeeds.

Blast radius

Successful exploitation could lead to full compromise of administrative or user accounts, enabling unauthorized access to APIs, data exfiltration, and potential lateral movement within connected systems.

Detection

Defenders should monitor authentication logs for repeated failed login attempts from the same source IP to credential validation endpoints (e.g., /api/login, /oauth/token), especially with high-frequency bursts and no subsequent success rate decline—this pattern may indicate brute-force activity before account lockout or throttling is enforced.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3, where the vendor has addressed the excessive authentication attempt vulnerability (CWE-307).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.