CVE-2026-17360

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain hard-coded credentials that allow an unauthenticated remote attacker to gain full administrative control of the system.

Exploitability

Exploitation is trivial for any remote attacker as no authentication or user interaction is required and the flaw stems from static, embedded credentials.

Blast radius

Successful exploitation grants attackers complete administrative control, enabling full compromise of confidentiality, integrity, and availability of the affected API management platform and potentially downstream systems it secures or manages.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, as this version resolves the hard-coded credential vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.