{"id":"CVE-2026-17280","kind":"vulnerability","aliases":["CVE-2026-17280"],"related":[],"title":"IBM API Connect: missing login-attempt limits let attackers brute-force credentials","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not restrict repeated authentication attempts. A remote attacker without an account can guess passwords until they obtain valid credentials.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your installed API Connect version. Exposed if it is 10.0.8.0 to 10.0.8.12, or V12 OnPrem 12.1.0.0 to 12.1.1.2. Fixed at 10.0.8.13 and v12.1.1.3. IBM lists no workaround or mitigation in the bulletin. Also check whether your login endpoints are reachable from the internet; IBM documents optional flood-control login limits (Failed IP/User login limit) but its bulletin does not name them as a mitigation for this CVE.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13; upgrade API Connect V12 OnPrem 12.1.x to v12.1.1.3. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:33+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","triaged_at":"2026-11-07T05:48:44+00:00","updated_at":"2026-11-07T06:23:01+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: missing login-attempt limits let attackers brute-force credentials","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not restrict repeated authentication attempts. A remote attacker without an account can guess passwords until they obtain valid credentials.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker obtains valid credentials and gains access to API management","analyst_note":"Confirm the fixed versions and any mitigation setting in IBM's security bulletin for CVE-2026-17280; the NVD entry alone does not state them.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges `10.0.8.0` to `10.0.8.12` and `12.1.0.0` to `12.1.1.2`\n- unknown for other checks: the sources do not say which setting or configuration controls the attempt limit","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, with its login endpoints reachable from the network. The sources do not say whether the default configuration is exposed or whether any setting mitigates it. unknown for who can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4244,"output_tokens":563,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any mitigation setting in IBM's security bulletin for CVE-2026-17280; the NVD entry alone does not state them.","search":"'-17280':17A,20A '-2026':16A,19A '10.0.8.0':44B,74C '10.0.8.12':46B,76C '12.1.0.0':48B,78C '12.1.1.2':50B,80C 'account':62B 'allow':82C 'api':2A,22A,25A,30B,34B,41B,72C 'api-connect':21A 'api-connect-v12-onprem':24A 'api-gateway':29B 'attack':10A,59B,85C,92C 'attempt':7A,56B,104C 'authent':55B,103C 'brute':12A,90C 'brute-forc':11A,89C 'connect':3A,23A,26A,35B,42B,73C 'could':81C 'credenti':14A,70B,96C 'cve':15A,18A 'due':97C 'excess':102C 'forc':13A,91C 'gateway':31B 'guess':64B 'host':38B 'ibm':1A,33B,40B,71C 'ibm-api-connect':32B 'improp':99C 'let':9A 'limit':8A 'login':6A 'login-attempt':5A 'miss':4A 'obtain':68B,94C 'onprem':28A 'password':65B 'perform':87C 'remot':58B,84C 'repeat':54B 'restrict':53B,100C 'self':37B 'self-host':36B 'unauthent':88C 'v12':27A 'valid':69B,95C 'vendor':39B 'version':43B 'without':60B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2 whose login endpoints can be reached over the network. An attacker needs no account but IBM rates attack complexity high. IBM lists no workaround. Anyone already on 10.0.8.13 or v12.1.1.3 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:23:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2062},"products":{"at":"2026-11-07T06:23:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2062},"how_to_check":{"at":"2026-11-07T06:23:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2062},"who_affected":{"at":"2026-11-07T06:23:01Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2062}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17280':17A,20A '-2026':16A,19A 'api':2A,22A,25A 'api-connect':21A 'api-connect-v12-onprem':24A 'attack':10A 'attempt':7A 'brute':12A 'brute-forc':11A 'connect':3A,23A,26A 'credenti':14A 'cve':15A,18A 'forc':13A 'ibm':1A 'let':9A 'limit':8A 'login':6A 'login-attempt':5A 'miss':4A 'onprem':28A 'v12':27A","search_b":"'10.0.8.0':44B '10.0.8.12':46B '12.1.0.0':48B '12.1.1.2':50B 'account':62B 'api':30B,34B,41B 'api-gateway':29B 'attack':59B 'attempt':56B 'authent':55B 'connect':35B,42B 'credenti':70B 'gateway':31B 'guess':64B 'host':38B 'ibm':33B,40B 'ibm-api-connect':32B 'obtain':68B 'password':65B 'remot':58B 'repeat':54B 'restrict':53B 'self':37B 'self-host':36B 'valid':69B 'vendor':39B 'version':43B 'without':60B","search_c":"'10.0.8.0':74C '10.0.8.12':76C '12.1.0.0':78C '12.1.1.2':80C 'allow':82C 'api':72C 'attack':85C,92C 'attempt':104C 'authent':103C 'brute':90C 'brute-forc':89C 'connect':73C 'could':81C 'credenti':96C 'due':97C 'excess':102C 'forc':91C 'ibm':71C 'improp':99C 'obtain':94C 'perform':87C 'remot':84C 'restrict':100C 'unauthent':88C 'valid':95C","first_public_at":"2026-11-07T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17280","severity":null,"published_at":"2026-11-07T05:18:33+00:00","modified_at":"2026-11-07T05:18:34+00:00","first_seen_at":"2026-11-07T05:46:01+00:00","fetched_at":"2026-11-07T05:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17280:2062","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T06:23:01+00:00","modified_at":"2026-11-07T06:23:01+00:00","first_seen_at":"2026-11-07T06:23:01+00:00","fetched_at":"2026-11-07T06:23:01+00:00","note":"Read IBM bulletins (-41 for 10.0.8.x, -39 for V12 OnPrem): both list CVE-2026-17280, fixes 10.0.8.13 / v12.1.1.3, workarounds None. No exploitation or PoC seen; X/posts not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}