{"id":"CVE-2026-17132","kind":"vulnerability","aliases":["CVE-2026-17132"],"related":[],"title":"IBM API Connect: SQL injection lets an authenticated user run database commands","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly neutralize special characters in SQL commands. A remote attacker with a valid account can run arbitrary SQL against the backing database.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","on-prem","self-hosted","sql-injection"],"not_affected_if":["auth-required","outside-affected-versions"],"how_to_check":"Check the installed API Connect V12 version; v12.1.0.0 through v12.1.1.2 is affected (IBM lists API Connect V12 OnPrem), v12.1.1.3 contains the fix.","fix":"Upgrade IBM API Connect V12 to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:48:13+00:00","updated_at":"2026-11-07T06:00:29+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: SQL injection lets an authenticated user run database commands","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly neutralize special characters in SQL commands. A remote attacker with a valid account can run arbitrary SQL against the backing database.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads or changes database contents via injected SQL","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed version and any workaround; NVD alone gives only the affected range.","how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where remote users have authenticated access. The sources do not describe specific configurations, so the exposure beyond the version range is unknown. Installations outside that version range are not affected by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4211,"output_tokens":513,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed version and any workaround; NVD alone gives only the affected range.","search":"'-17132':15A,18A '-2026':14A,17A '12.1.0.0':45B,75C '12.1.1.2':47B,77C 'account':63B 'allow':79C 'api':2A,20A,25B,29B,42B,73C 'api-gateway':24B 'arbitrari':66B,86C 'attack':59B,83C 'authent':8A,82C 'back':70B 'charact':53B 'command':12A,56B,88C,100C 'connect':3A,21A,30B,43B,74C 'could':78C 'cve':13A,16A 'databas':11A,71B 'due':89C 'element':95C 'execut':85C 'gateway':26B 'host':37B 'ibm':1A,19A,28B,41B,72C 'ibm-api-connect':27B 'improp':91C 'infrastructur':31B 'inject':5A,40B 'let':6A 'neutral':51B,92C 'on-prem':32B 'onprem':23A 'prem':34B 'proper':50B 'remot':58B,81C 'run':10A,65B 'self':36B 'self-host':35B 'special':52B,94C 'sql':4A,39B,55B,67B,87C,99C 'sql-inject':38B 'use':96C 'user':9A 'v12':22A 'valid':62B 'version':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (on-prem) IBM API Connect V12, versions 12.1.0.0 through 12.1.1.2. An attacker needs a valid low-privilege account and network access; the flaw lets them run arbitrary SQL against the backing database (IBM CVSS 9.9). Teams on other API Connect lines or not running API Connect can skip it; IBM's bulletin lists only V12 OnPrem.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:00:29Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1992},"products":{"at":"2026-11-07T06:00:29Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1992},"workarounds":{"at":"2026-11-07T06:00:29Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1992},"how_to_check":{"at":"2026-11-07T06:00:29Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1992},"who_affected":{"at":"2026-11-07T06:00:29Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1992}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","onprem","selfhosted","sqlinjection"],"campaign_type":null,"search_a":"'-17132':15A,18A '-2026':14A,17A 'api':2A,20A 'authent':8A 'command':12A 'connect':3A,21A 'cve':13A,16A 'databas':11A 'ibm':1A,19A 'inject':5A 'let':6A 'onprem':23A 'run':10A 'sql':4A 'user':9A 'v12':22A","search_b":"'12.1.0.0':45B '12.1.1.2':47B 'account':63B 'api':25B,29B,42B 'api-gateway':24B 'arbitrari':66B 'attack':59B 'back':70B 'charact':53B 'command':56B 'connect':30B,43B 'databas':71B 'gateway':26B 'host':37B 'ibm':28B,41B 'ibm-api-connect':27B 'infrastructur':31B 'inject':40B 'neutral':51B 'on-prem':32B 'prem':34B 'proper':50B 'remot':58B 'run':65B 'self':36B 'self-host':35B 'special':52B 'sql':39B,55B,67B 'sql-inject':38B 'valid':62B 'version':44B","search_c":"'12.1.0.0':75C '12.1.1.2':77C 'allow':79C 'api':73C 'arbitrari':86C 'attack':83C 'authent':82C 'command':88C,100C 'connect':74C 'could':78C 'due':89C 'element':95C 'execut':85C 'ibm':72C 'improp':91C 'neutral':92C 'remot':81C 'special':94C 'sql':87C,99C 'use':96C","first_public_at":"2026-11-07T05:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17132","severity":null,"published_at":"2026-11-07T05:18:26+00:00","modified_at":"2026-11-07T05:18:26+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17132:1992","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:00:29+00:00","modified_at":"2026-11-07T06:00:29+00:00","first_seen_at":"2026-11-07T06:00:29+00:00","fetched_at":"2026-11-07T06:00:29+00:00","note":"Read IBM bulletin node/7295635 (one of many CVEs fixed in 12.1.1.3); affected, fix, no workarounds all from IBM text. No exploitation/PoC evidence found; did not search social.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}