CVE-2026-17313

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authentication bypass vulnerability (CWE-288) that allows unauthenticated remote attackers to access sensitive gateway configuration data and potentially take control of the gateway via an alternate, unprotected path.

Exploitability

Exploitation is highly likely due to the CVSS vector indicating network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N).

Blast radius

Successful exploitation could lead to full compromise of the API gateway, enabling attackers to intercept, modify, or block API traffic, exfiltrate sensitive configuration data, and potentially pivot into internal systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.2.0 or later, which contains the official fix for this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.