CVE-2026-18838

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 lack sufficient identity verification, allowing unauthenticated remote attackers to impersonate users and gain unauthorized access to sensitive data and modify API configurations due to improper authentication (CWE-290).

Exploitability

Exploitation is straightforward for remote attackers as no authentication or user interaction is required (CVSS vector AV:N/AC:L/PR:N/UI:N), relying solely on sending specially crafted requests that bypass insufficient identity checks.

Blast radius

Successful exploitation could lead to full compromise of confidentiality and integrity of API data and configurations across all tenants sharing the affected IBM API Connect instance, with limited impact on availability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.