CVE-2026-17403

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain hard-coded credentials that allow an unauthenticated remote attacker to gain full administrative control of the system. This is a critical authentication bypass vulnerability (CWE-798) enabling complete compromise of confidentiality, integrity, and availability.

Exploitability

Exploitation requires no prior access or user interaction but may require network access to administrative endpoints; the high attack complexity (AC:H) suggests non-trivial conditions such as specific endpoint paths or request patterns must be met.

Blast radius

Successful exploitation grants full administrative control, enabling attackers to exfiltrate sensitive data, modify configurations, deploy malicious services, or disrupt API management operations across the entire IBM API Connect deployment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, as these versions contain the fix for the hard-coded credential vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.