CVE-2026-17362

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack proper authorization checks, allowing unauthenticated remote attackers to create, modify, or delete tenants — a high-privilege administrative function.

Exploitability

Exploitation is trivial for any remote attacker with network access, as no authentication, privileges, or user interaction are required.

Blast radius

Successful exploitation could lead to full tenant compromise, including data exfiltration, service disruption, and unauthorized deployment of malicious APIs across the platform.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the official fix for this authorization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.