{"id":"CVE-2026-17321","kind":"vulnerability","aliases":["CVE-2026-17321"],"related":[],"title":"IBM API Connect: authenticated users can delete or overwrite control-plane assets","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference that lets a logged-in remote user target arbitrary control-plane assets. An attacker can delete or overwrite those assets, which can disrupt or alter how APIs are managed.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-management","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"Check your IBM API Connect V12 on-prem version. Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix. IBM lists no workaround. The bulletin covers many other CVEs fixed in the same release.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","triaged_at":"2026-11-07T05:50:30+00:00","updated_at":"2026-11-07T06:18:34+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:50:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can delete or overwrite control-plane assets","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an insecure direct object reference that lets a logged-in remote user target arbitrary control-plane assets. An attacker can delete or overwrite those assets, which can disrupt or alter how APIs are managed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-management","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated remote user deletes or overwrites control-plane API assets","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected permissions; NVD alone gives no fix.","how_to_check":"- Confirm the installed IBM API Connect version is in the range 12.1.0.0 through 12.1.1.2\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations that run IBM API Connect 12.1.0.0 through 12.1.1.2 with user accounts that can reach the management plane are exposed. Installations on other versions, or those without authenticated remote access, are not in the stated range. The sources do not describe further configuration conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4205,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version and affected permissions; NVD alone gives no fix.","search":"'-17321':16A,19A '-2026':15A,18A '12.1.0.0':39B,82C '12.1.1.2':41B,84C 'allow':86C 'alter':74B 'api':2A,20A,25B,29B,36B,76B,80C 'api-manag':24B 'arbitrari':57B,95C 'asset':13A,61B,69B,99C 'attack':63B,90C 'authent':4A,89C 'connect':3A,21A,30B,37B,81C 'contain':42B 'control':11A,59B,97C 'control-plan':10A,58B,96C 'could':85C 'cve':14A,17A 'delet':7A,65B,92C 'direct':45B,104C 'disrupt':72B 'due':100C 'host':33B 'ibm':1A,28B,35B,79C 'ibm-api-connect':27B 'insecur':44B,103C 'let':49B 'log':52B 'logged-in':51B 'manag':26B,78B 'object':46B,105C 'onprem':23A 'overwrit':9A,67B,94C 'plane':12A,60B,98C 'refer':47B,106C 'remot':54B,88C 'self':32B 'self-host':31B 'target':56B 'user':5A,55B 'v12':22A 'vendor':34B 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 on-prem, versions 12.1.0.0 through 12.1.1.2, are exposed. Any remote user with a valid login can reach other users' control-plane assets by changing an identifier (insecure direct object reference, CWE-639) and delete or overwrite them. IBM lists no workaround. Other versions are not in the range IBM lists for this bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:18:34Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2046},"products":{"at":"2026-11-07T06:18:34Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2046},"how_to_check":{"at":"2026-11-07T06:18:34Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2046},"who_affected":{"at":"2026-11-07T06:18:34Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2046}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apimanagement","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17321':16A,19A '-2026':15A,18A 'api':2A,20A 'asset':13A 'authent':4A 'connect':3A,21A 'control':11A 'control-plan':10A 'cve':14A,17A 'delet':7A 'ibm':1A 'onprem':23A 'overwrit':9A 'plane':12A 'user':5A 'v12':22A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'alter':74B 'api':25B,29B,36B,76B 'api-manag':24B 'arbitrari':57B 'asset':61B,69B 'attack':63B 'connect':30B,37B 'contain':42B 'control':59B 'control-plan':58B 'delet':65B 'direct':45B 'disrupt':72B 'host':33B 'ibm':28B,35B 'ibm-api-connect':27B 'insecur':44B 'let':49B 'log':52B 'logged-in':51B 'manag':26B,78B 'object':46B 'overwrit':67B 'plane':60B 'refer':47B 'remot':54B 'self':32B 'self-host':31B 'target':56B 'user':55B 'vendor':34B 'version':38B","search_c":"'12.1.0.0':82C '12.1.1.2':84C 'allow':86C 'api':80C 'arbitrari':95C 'asset':99C 'attack':90C 'authent':89C 'connect':81C 'control':97C 'control-plan':96C 'could':85C 'delet':92C 'direct':104C 'due':100C 'ibm':79C 'insecur':103C 'object':105C 'overwrit':94C 'plane':98C 'refer':106C 'remot':88C","first_public_at":"2026-11-07T05:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17321","severity":null,"published_at":"2026-11-07T05:18:41+00:00","modified_at":"2026-11-07T05:18:41+00:00","first_seen_at":"2026-11-07T05:46:03+00:00","fetched_at":"2026-11-07T05:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17321:2046","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:18:34+00:00","modified_at":"2026-11-07T06:18:34+00:00","first_seen_at":"2026-11-07T06:18:34+00:00","fetched_at":"2026-11-07T06:18:34+00:00","note":"Read IBM bulletin 7295635: affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, workarounds none. Not exploited/no PoC seen.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}