{"id":"CVE-2026-17158","kind":"vulnerability","aliases":["CVE-2026-17158"],"related":[],"title":"IBM API Connect: any authenticated user can gain elevated privileges (fixed in 10.0.8.13 and 12.1.1.3)","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have an improper authentication flaw. A remote attacker with a valid account can gain elevated privileges.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Affected per IBM: V10.0.8.0 - V10.0.8.12 and API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3.","fix":"Upgrade to 10.0.8.13 (10.0.8.x) or v12.1.1.3 (V12 OnPrem 12.1.x). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:48:08+00:00","updated_at":"2026-11-07T05:59:19+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated remote users can gain elevated privileges","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have an improper authentication flaw. A remote attacker with a valid account can gain elevated privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with a valid account gains elevated privileges on the platform","analyst_note":"Check the IBM security bulletin for this CVE for fixed versions and mitigations; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. Exposure requires an authenticated account on the platform, so the team should review which users hold accounts. unknown for further detail; the sources do not say which deployment modes are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000686,"input_tokens":4224,"output_tokens":528,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for fixed versions and mitigations; the NVD entry alone gives no fix.","search":"'-17158':18A,21A '-2026':17A,20A '10.0.8.0':48B,74C '10.0.8.12':50B,76C '10.0.8.13':13A '12.1.0.0':52B,78C '12.1.1.2':54B,80C '12.1.1.3':15A 'account':66B 'allow':82C 'api':2A,23A,26A,31B,38B,45B,72C 'api-connect':22A 'api-connect-v12-onprem':25A 'api-gateway':30B 'attack':62B,86C 'auth':34B 'auth-requir':33B 'authent':5A,58B,85C,94C 'connect':3A,24A,27A,39B,46B,73C 'could':81C 'cve':16A,19A 'due':91C 'elev':9A,69B,89C 'fix':11A 'flaw':59B 'gain':8A,68B,88C 'gateway':32B 'host':43B 'ibm':1A,37B,44B,71C 'ibm-api-connect':36B 'improp':57B,93C 'infrastructur':40B 'onprem':29A 'privileg':10A,70B,90C 'remot':61B,84C 'requir':35B 'self':42B 'self-host':41B 'user':6A 'v12':28A 'valid':65B 'version':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2. Any account on the platform can be used by an attacker to gain elevated privileges (improper authentication, CWE-287; CVSS 9.9 with changed scope), so exposure depends on who can hold an account. IBM does not describe the exact mechanism. Teams on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:59:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1988},"products":{"at":"2026-11-07T05:59:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1988},"workarounds":{"at":"2026-11-07T05:59:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1988},"how_to_check":{"at":"2026-11-07T05:59:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1988},"who_affected":{"at":"2026-11-07T05:59:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1988}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17158':18A,21A '-2026':17A,20A '10.0.8.13':13A '12.1.1.3':15A 'api':2A,23A,26A 'api-connect':22A 'api-connect-v12-onprem':25A 'authent':5A 'connect':3A,24A,27A 'cve':16A,19A 'elev':9A 'fix':11A 'gain':8A 'ibm':1A 'onprem':29A 'privileg':10A 'user':6A 'v12':28A","search_b":"'10.0.8.0':48B '10.0.8.12':50B '12.1.0.0':52B '12.1.1.2':54B 'account':66B 'api':31B,38B,45B 'api-gateway':30B 'attack':62B 'auth':34B 'auth-requir':33B 'authent':58B 'connect':39B,46B 'elev':69B 'flaw':59B 'gain':68B 'gateway':32B 'host':43B 'ibm':37B,44B 'ibm-api-connect':36B 'improp':57B 'infrastructur':40B 'privileg':70B 'remot':61B 'requir':35B 'self':42B 'self-host':41B 'valid':65B 'version':47B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':86C 'authent':85C,94C 'connect':73C 'could':81C 'due':91C 'elev':89C 'gain':88C 'ibm':71C 'improp':93C 'privileg':90C 'remot':84C","first_public_at":"2026-11-07T05:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17158","severity":null,"published_at":"2026-11-07T05:18:28+00:00","modified_at":"2026-11-07T05:18:29+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17158:1988","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:59:19+00:00","modified_at":"2026-11-07T05:59:19+00:00","first_seen_at":"2026-11-07T05:59:19+00:00","fetched_at":"2026-11-07T05:59:19+00:00","note":"Read IBM bulletins -41 (10.0.8.x, fix 10.0.8.13) and -39 (V12 OnPrem, fix 12.1.1.3); both list CVE-2026-17158, workarounds None. No exploitation or PoC evidence found; no social search done.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}