CVE-2026-17327

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability (CWE-918) that allows an authenticated remote attacker to access internal or external resources via the vulnerable server, potentially exposing sensitive information.

Exploitability

Exploitation requires valid authentication and no user interaction, with low attack complexity, meaning a compromised or stolen credential is sufficient to trigger the flaw.

Blast radius

Successful exploitation could lead to exposure of internal network data, cloud metadata services, or backend systems accessible to the API Connect server, compromising confidentiality and enabling further lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, as this version contains the fix for CVE-2026-17327.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.