CVE-2026-17396

Summary

IBM API Connect contains a SQL injection vulnerability (CWE-89) in authenticated endpoints, allowing a remote attacker with valid credentials to extract sensitive data from the underlying database.

Exploitability

Exploitation requires valid authentication and knowledge of vulnerable input fields; no public exploit is available, but the CVSS score indicates low attack complexity.

Blast radius

Successful exploitation could lead to full compromise of backend database contents, including credentials, API keys, or customer data, depending on database permissions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or later, or 12.1.1.3 or later, as these versions contain the vendor-provided fix for CVE-2026-17396.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.