{"id":"CVE-2026-17332","kind":"vulnerability","aliases":["CVE-2026-17332"],"related":[],"title":"IBM API Connect: improper certificate validation lets remote attackers bypass restrictions","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can use this to bypass security restrictions.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","on-prem","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect V12 OnPrem version; versions v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 contains the fix. IBM's bulletin does not name a command or file.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (IBM Fix Central: https://www.ibm.com/support/pages/node/7290205).","status":"open","published_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:54+00:00","updated_at":"2026-11-07T06:16:23+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: improper certificate validation lets remote attackers bypass restrictions","impact":"medium","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can use this to bypass security restrictions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker bypasses security restrictions on the API platform","analyst_note":"Check the IBM security bulletin for CVE-2026-17332 for the fixed version and the exact exposed configuration; the NVD entry alone does not give them.","how_to_check":"- Check the installed IBM API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- Confirm the version from the product's management console or installation metadata; the sources do not name a specific file or command","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range. The sources do not describe which deployment or configuration paths are exposed beyond the version range and the certificate validation flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4188,"output_tokens":513,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-17332 for the fixed version and the exact exposed configuration; the NVD entry alone does not give them.","search":"'-17332':14A,17A '-2026':13A,16A '12.1.0.0':40B,61C '12.1.1.2':42B,63C 'allow':65C 'api':2A,18A,23B,27B,37B,59C 'api-gateway':22B 'attack':9A,50B,68C 'bypass':10A,55B,70C 'certif':5A,46B,76C 'connect':3A,19A,28B,38B,60C 'could':64C 'cve':12A,15A 'due':73C 'gateway':24B 'host':35B 'ibm':1A,26B,36B,58C 'ibm-api-connect':25B 'improp':4A,75C 'infrastructur':29B 'let':7A 'on-prem':30B 'onprem':21A 'prem':32B 'proper':47B 'remot':8A,49B,67C 'restrict':11A,57B,72C 'secur':56B,71C 'self':34B 'self-host':33B 'use':52B 'v12':20A 'valid':6A,45B,77C 'version':39B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect V12 OnPrem at v12.1.0.0 to v12.1.1.2. IBM describes a remote, unauthenticated attacker bypassing security restrictions through improper certificate validation (CWE-295); attack complexity is rated high. IBM's bulletin lists only V12 OnPrem as affected, so the 10.0.8.x line is not listed for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:16:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2037},"products":{"at":"2026-11-07T06:16:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2037},"workarounds":{"at":"2026-11-07T06:16:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2037},"how_to_check":{"at":"2026-11-07T06:16:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2037},"who_affected":{"at":"2026-11-07T06:16:23Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":2037}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","infrastructure","onprem","selfhosted"],"campaign_type":null,"search_a":"'-17332':14A,17A '-2026':13A,16A 'api':2A,18A 'attack':9A 'bypass':10A 'certif':5A 'connect':3A,19A 'cve':12A,15A 'ibm':1A 'improp':4A 'let':7A 'onprem':21A 'remot':8A 'restrict':11A 'v12':20A 'valid':6A","search_b":"'12.1.0.0':40B '12.1.1.2':42B 'api':23B,27B,37B 'api-gateway':22B 'attack':50B 'bypass':55B 'certif':46B 'connect':28B,38B 'gateway':24B 'host':35B 'ibm':26B,36B 'ibm-api-connect':25B 'infrastructur':29B 'on-prem':30B 'prem':32B 'proper':47B 'remot':49B 'restrict':57B 'secur':56B 'self':34B 'self-host':33B 'use':52B 'valid':45B 'version':39B","search_c":"'12.1.0.0':61C '12.1.1.2':63C 'allow':65C 'api':59C 'attack':68C 'bypass':70C 'certif':76C 'connect':60C 'could':64C 'due':73C 'ibm':58C 'improp':75C 'remot':67C 'restrict':72C 'secur':71C 'valid':77C","first_public_at":"2026-11-07T05:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17332","severity":null,"published_at":"2026-11-07T05:18:43+00:00","modified_at":"2026-11-07T05:18:43+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17332:2037","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:16:23+00:00","modified_at":"2026-11-07T06:16:23+00:00","first_seen_at":"2026-11-07T06:16:23+00:00","fetched_at":"2026-11-07T06:16:23+00:00","note":"IBM bulletin (-39, published 2026-11-05) lists CVE-2026-17332, CVSS 8.7, CWE-295; fix v12.1.1.3; IBM states no workarounds. No exploitation or PoC reported in the bulletin; did not search social.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}