CVE-2026-17407

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain an SQL injection vulnerability (CWE-89) in the sign-in flow, where untrusted input is improperly used in a database query without sanitization. This allows an authenticated attacker to inject and execute arbitrary SQL commands.

Exploitability

Exploitation requires valid authentication credentials and high skill due to the CVSS attack complexity being HIGH, meaning non-trivial conditions or precise payload construction are likely needed.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the underlying database and potentially the host system, depending on database permissions and configuration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the fix for CVE-2026-17407.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.