{"id":"CVE-2026-16718","kind":"vulnerability","aliases":["CVE-2026-16718"],"related":[],"title":"IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2: authenticated path traversal exposes sensitive information; fixed in 10.0.8.13 and 12.1.1.3","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.","summary":"IBM API Connect 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 do not properly validate file paths (CWE-22). A remote authenticated attacker can read sensitive information. IBM fixed it in 10.0.8.13 and 12.1.1.3; no workaround is listed.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version","versions-outside-affected-ranges"],"how_to_check":"Check the installed API Connect version: affected are 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. Fixed in 10.0.8.13 and 12.1.1.3. IBM does not name the vulnerable endpoint.","fix":"Upgrade API Connect 10.0.8.x to 10.0.8.13, or 12.1.x to 12.1.1.3, via IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","triaged_at":"2026-11-07T05:50:54+00:00","updated_at":"2026-11-07T06:26:12+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-07T05:50:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: file path validation flaw leaks sensitive information to authenticated users","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not properly validate file paths. A remote attacker with a valid account can use this to read sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated remote user reads sensitive files or information","analyst_note":"Check the IBM security bulletin for CVE-2026-16718 for the fixed versions and affected endpoints; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-affected-ranges"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold valid accounts. The sources do not describe which endpoints or configurations are involved, so unknown beyond the version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4226,"output_tokens":531,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-16718 for the fixed versions and affected endpoints; the NVD entry alone gives no fix.","search":"'-16718':22A,25A '-2026':21A,24A '-22':57B '10.0.8.0':4A,45B,80C '10.0.8.12':5A,46B,82C '10.0.8.13':17A,70B '12.1.0.0':7A,48B,84C '12.1.1.2':8A,49B,86C '12.1.1.3':19A,72B 'allow':88C 'api':2A,26A,28A,32B,36B,43B,78C 'api-gateway':31B 'attack':61B,92C 'authent':9A,60B,91C 'connect':3A,27A,29A,37B,44B,79C 'could':87C 'cve':20A,23A 'cwe':56B 'due':97C 'expos':12A 'file':54B,102C 'fix':15A,67B 'gateway':33B 'host':41B 'ibm':1A,35B,42B,66B,77C 'ibm-api-connect':34B 'improp':99C 'inform':14A,65B,96C 'infrastructur':38B 'list':76B 'obtain':94C 'path':10A,55B,103C 'proper':52B 'read':63B 'remot':59B,90C 'self':40B 'self-host':39B 'sensit':13A,64B,95C 'travers':11A 'v12':30A 'valid':53B,100C 'workaround':74B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2 where users can hold valid accounts: any such account can exploit improper file path validation (path traversal) to read sensitive information. IBM does not name the endpoint or a required setting. Instances already on 10.0.8.13 or 12.1.1.3 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:26:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2074},"how_to_check":{"at":"2026-11-07T06:26:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2074}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12","connect","connectv12"],"ptokens":["api","connect","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-16718':22A,25A '-2026':21A,24A '10.0.8.0':4A '10.0.8.12':5A '10.0.8.13':17A '12.1.0.0':7A '12.1.1.2':8A '12.1.1.3':19A 'api':2A,26A,28A 'authent':9A 'connect':3A,27A,29A 'cve':20A,23A 'expos':12A 'fix':15A 'ibm':1A 'inform':14A 'path':10A 'sensit':13A 'travers':11A 'v12':30A","search_b":"'-22':57B '10.0.8.0':45B '10.0.8.12':46B '10.0.8.13':70B '12.1.0.0':48B '12.1.1.2':49B '12.1.1.3':72B 'api':32B,36B,43B 'api-gateway':31B 'attack':61B 'authent':60B 'connect':37B,44B 'cwe':56B 'file':54B 'fix':67B 'gateway':33B 'host':41B 'ibm':35B,42B,66B 'ibm-api-connect':34B 'inform':65B 'infrastructur':38B 'list':76B 'path':55B 'proper':52B 'read':63B 'remot':59B 'self':40B 'self-host':39B 'sensit':64B 'valid':53B 'workaround':74B","search_c":"'10.0.8.0':80C '10.0.8.12':82C '12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':78C 'attack':92C 'authent':91C 'connect':79C 'could':87C 'due':97C 'file':102C 'ibm':77C 'improp':99C 'inform':96C 'obtain':94C 'path':103C 'remot':90C 'sensit':95C 'valid':100C","first_public_at":"2026-11-07T05:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16718","severity":null,"published_at":"2026-11-07T05:18:21+00:00","modified_at":"2026-11-07T05:18:21+00:00","first_seen_at":"2026-11-07T05:45:57+00:00","fetched_at":"2026-11-07T05:45:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16718:2074","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:26:12+00:00","modified_at":"2026-11-07T06:26:12+00:00","first_seen_at":"2026-11-07T06:26:12+00:00","fetched_at":"2026-11-07T06:26:12+00:00","note":"IBM bulletins -41 (10.0.8.13) and -39 (v12.1.1.3) both list CVE-2026-16718, CWE-22, CVSS 7.7. -41 table shows 10.0.8.0-10.0.8.12; V12 range from NVD/IBM CVE record. No workaround listed; endpoint not named. Only the 10.0.8 fix/check verified from -41 text; V12 table not read.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}