{"id":"CVE-2026-17309","kind":"vulnerability","aliases":["CVE-2026-17309"],"related":[],"title":"IBM API Connect: improper certificate validation exposes data and config tampering","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate certificates. A remote attacker may be able to obtain sensitive information and change configuration.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["managed-hosting","v10-release"],"how_to_check":"Check your IBM API Connect V12 on-prem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix.","fix":"Upgrade IBM API Connect V12 to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","triaged_at":"2026-11-07T05:50:31+00:00","updated_at":"2026-11-07T06:19:49+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: improper certificate validation exposes data and config tampering","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not properly validate certificates. A remote attacker may be able to obtain sensitive information and change configuration.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive information and tampers with configuration","analyst_note":"Find IBM's security bulletin for CVE-2026-17309 to confirm the fixed version, the trigger conditions and the required privileges.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2. The sources do not describe the specific deployment path or configuration that triggers the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":4198,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17309 to confirm the fixed version, the trigger conditions and the required privileges.","search":"'-17309':14A,17A '-2026':13A,16A '12.1.0.0':36B,60C '12.1.1.2':38B,62C 'abl':49B 'allow':64C 'api':2A,19A,22B,26B,33B,58C 'api-gateway':21B 'attack':46B,67C 'certif':5A,43B,79C 'chang':55B 'config':10A 'configur':56B,75C 'connect':3A,20A,27B,34B,59C 'could':63C 'cve':12A,15A 'data':8A 'due':76C 'expos':7A 'gateway':23B 'host':30B 'ibm':1A,18A,25B,32B,57C 'ibm-api-connect':24B 'improp':4A,78C 'inform':53B,71C 'may':47B 'obtain':51B,69C 'proper':41B 'remot':45B,66C 'self':29B 'self-host':28B 'sensit':52B,70C 'tamper':11A,73C 'valid':6A,42B,80C 'vendor':31B 'version':35B","nicknames":[],"mitigations":[],"who_affected":"Self-managed (on-prem) IBM API Connect V12 deployments running v12.1.0.0 through v12.1.1.2. IBM rates it CVSS 8.0 with an adjacent-network, high-complexity, no-privileges vector, so it matters most where an attacker can reach the network segment API Connect uses. IBM's bulletin lists only API Connect V12 OnPrem as affected, so V10 and other deployment types can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:19:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2052},"products":{"at":"2026-11-07T06:19:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2052},"how_to_check":{"at":"2026-11-07T06:19:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2052},"who_affected":{"at":"2026-11-07T06:19:49Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2052}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","ibmapiconnect"],"ptokens":["api","connect","ibm"],"labels":["apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17309':14A,17A '-2026':13A,16A 'api':2A,19A 'certif':5A 'config':10A 'connect':3A,20A 'cve':12A,15A 'data':8A 'expos':7A 'ibm':1A,18A 'improp':4A 'tamper':11A 'valid':6A","search_b":"'12.1.0.0':36B '12.1.1.2':38B 'abl':49B 'api':22B,26B,33B 'api-gateway':21B 'attack':46B 'certif':43B 'chang':55B 'configur':56B 'connect':27B,34B 'gateway':23B 'host':30B 'ibm':25B,32B 'ibm-api-connect':24B 'inform':53B 'may':47B 'obtain':51B 'proper':41B 'remot':45B 'self':29B 'self-host':28B 'sensit':52B 'valid':42B 'vendor':31B 'version':35B","search_c":"'12.1.0.0':60C '12.1.1.2':62C 'allow':64C 'api':58C 'attack':67C 'certif':79C 'configur':75C 'connect':59C 'could':63C 'due':76C 'ibm':57C 'improp':78C 'inform':71C 'obtain':69C 'remot':66C 'sensit':70C 'tamper':73C 'valid':80C","first_public_at":"2026-11-07T05:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17309","severity":null,"published_at":"2026-11-07T05:18:39+00:00","modified_at":"2026-11-07T05:18:39+00:00","first_seen_at":"2026-11-07T05:46:02+00:00","fetched_at":"2026-11-07T05:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17309:2052","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:19:49+00:00","modified_at":"2026-11-07T06:19:49+00:00","first_seen_at":"2026-11-07T06:19:49+00:00","fetched_at":"2026-11-07T06:19:49+00:00","note":"IBM bulletin (api-connect-39, 2026-11-05) lists CVE-2026-17309: improper cert validation, CVSS 8.0 AV:A/AC:H/PR:N, affected V12 OnPrem 12.1.0.0-12.1.1.2, fixed 12.1.1.3, workarounds: None. Bulletin gives no further trigger details; exploitation not reported.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}