---
id: "CVE-2026-17280"
page: "https://infrastack.ai/live/CVE-2026-17280"
kind: "vulnerability"
aliases: ["CVE-2026-17280"]
title: "IBM API Connect: missing login-attempt limits let attackers brute-force credentials"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "api-connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "api-connect-v12-onprem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-07T05:18:33+00:00"
first_seen_at: "2026-11-07T05:46:01+00:00"
updated_at: "2026-11-07T06:23:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17280", "first_seen_at": "2026-11-07T05:46:01+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "first_seen_at": "2026-11-07T06:23:01+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: missing login-attempt limits let attackers brute-force credentials

Link for people: https://infrastack.ai/live/CVE-2026-17280 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not restrict repeated authentication attempts. A remote attacker without an account can guess passwords until they obtain valid credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:api-connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:api-connect-v12-onprem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your installed API Connect version. Exposed if it is 10.0.8.0 to 10.0.8.12, or V12 OnPrem 12.1.0.0 to 12.1.1.2. Fixed at 10.0.8.13 and v12.1.1.3. IBM lists no workaround or mitigation in the bulletin. Also check whether your login endpoints are reachable from the internet; IBM documents optional flood-control login limits (Failed IP/User login limit) but its bulletin does not name them as a mitigation for this CVE.

## Fix

Upgrade IBM API Connect 10.0.8.x to 10.0.8.13; upgrade API Connect V12 OnPrem 12.1.x to v12.1.1.3. IBM lists no workaround.

## Timeline

- 2026-11-07T05:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17280
- 2026-11-07T06:23:01+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41 — Read IBM bulletins (-41 for 10.0.8.x, -39 for V12 OnPrem): both list CVE-2026-17280, fixes 10.0.8.13 / v12.1.1.3, workarounds None. No exploitation or PoC seen; X/posts not searched.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_