CVE-2026-17301
9.8 CRITICALPublished 2026-11-07 · Updated 2026-11-10
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to bypass authentication in IBM API Connect by exploiting improper cryptographic signature verification (CWE-347), enabling full compromise of confidentiality, integrity, and availability.
- Exploitability
- Exploitation is highly likely for remote attackers due to the CVSS vector (AV:N/AC:L/PR:N/UI:N) and lack of authentication requirements.
- Blast radius
- Successful exploitation would grant unauthenticated attackers full control over affected API Connect instances, potentially affecting all APIs and tenants managed by the platform.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.
auth-bypasscrypto-flawcwe-347api-gatewayibm
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Vendors
ibm
Products
api connect
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-17049
- CRITICALCVE-2026-17296
- CRITICALCVE-2026-10141
- CRITICALCVE-2026-120017
- CRITICALCVE-2026-125298PoC
- HIGHCVE-2026-63182PoC
- HIGHCVE-2026-109140
- HIGHCVE-2026-117545
Related by shared AI tags and CWE weakness class. Browse the full archive.