{"id":"CVE-2026-17333","kind":"vulnerability","aliases":["CVE-2026-17333"],"related":[],"title":"IBM API Connect: certificate validation flaw lets remote attackers bypass authentication","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can bypass authentication and push unauthorized configuration changes.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["10.0.8.13-or-later","12.1.1.3-or-later","other-versions"],"how_to_check":"Check your API Connect version. Affected: 10.0.8.0 through 10.0.8.12, and 12.1.0.0 through 12.1.1.2 (IBM lists 'API Connect V12 OnPrem'). Fixed: 10.0.8.13 and 12.1.1.3.","fix":"Upgrade to API Connect 10.0.8.13 (10.0.8 line) or v12.1.1.3 (12.1 line). Fix Central: https://www.ibm.com/support/pages/node/7290205 (12.1).","status":"open","published_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:50:30+00:00","updated_at":"2026-11-07T06:15:25+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:50:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: certificate validation flaw lets remote attackers bypass authentication","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not validate certificates properly. A remote attacker can bypass authentication and push unauthorized configuration changes.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker bypasses authentication and changes API gateway configuration","analyst_note":"Find IBM's security bulletin for CVE-2026-17333 to confirm the fixed versions, required configuration, and whether the flaw is reachable without credentials.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where the management or gateway endpoint accepts remote connections. The sources do not say which deployment roles or settings are required, so teams on other versions can skip it. unknown for specifics.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4232,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17333 to confirm the fixed versions, required configuration, and whether the flaw is reachable without credentials.","search":"'-17333':14A,17A '-2026':13A,16A '10.0.8.0':42B,68C '10.0.8.12':44B,70C '12.1.0.0':46B,72C '12.1.1.2':48B,74C 'adjac':25B 'adjacent-network':24B 'allow':76C 'api':2A,18A,20A,28B,32B,39B,66C 'api-gateway':27B 'attack':9A,56B,79C 'authent':11A,59B,82C 'bypass':10A,58B,81C 'certif':4A,52B,91C 'chang':64B,87C 'configur':63B,86C 'connect':3A,19A,21A,33B,40B,67C 'could':75C 'cve':12A,15A 'due':88C 'flaw':6A 'gateway':29B 'host':36B 'ibm':1A,31B,38B,65C 'ibm-api-connect':30B 'improp':90C 'inject':84C 'let':7A 'network':26B 'onprem':23A 'proper':53B 'push':61B 'remot':8A,55B,78C 'self':35B 'self-host':34B 'unauthor':62B,85C 'v12':22A 'valid':5A,51B,92C 'vendor':37B 'version':41B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (on-prem) IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. IBM scores this CVSS 8.0 with an adjacent-network vector (AV:A, high complexity, no privileges): the attacker needs network adjacency to the API Connect components, not necessarily the internet. IBM lists no workaround; other versions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036},"products":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036},"mitigations":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036},"workarounds":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036},"how_to_check":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036},"who_affected":{"at":"2026-11-07T06:15:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":2036}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["adjacentnetwork","apigateway","high","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17333':14A,17A '-2026':13A,16A 'api':2A,18A,20A 'attack':9A 'authent':11A 'bypass':10A 'certif':4A 'connect':3A,19A,21A 'cve':12A,15A 'flaw':6A 'ibm':1A 'let':7A 'onprem':23A 'remot':8A 'v12':22A 'valid':5A","search_b":"'10.0.8.0':42B '10.0.8.12':44B '12.1.0.0':46B '12.1.1.2':48B 'adjac':25B 'adjacent-network':24B 'api':28B,32B,39B 'api-gateway':27B 'attack':56B 'authent':59B 'bypass':58B 'certif':52B 'chang':64B 'configur':63B 'connect':33B,40B 'gateway':29B 'host':36B 'ibm':31B,38B 'ibm-api-connect':30B 'network':26B 'proper':53B 'push':61B 'remot':55B 'self':35B 'self-host':34B 'unauthor':62B 'valid':51B 'vendor':37B 'version':41B","search_c":"'10.0.8.0':68C '10.0.8.12':70C '12.1.0.0':72C '12.1.1.2':74C 'allow':76C 'api':66C 'attack':79C 'authent':82C 'bypass':81C 'certif':91C 'chang':87C 'configur':86C 'connect':67C 'could':75C 'due':88C 'ibm':65C 'improp':90C 'inject':84C 'remot':78C 'unauthor':85C 'valid':92C","first_public_at":"2026-11-07T05:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17333","severity":null,"published_at":"2026-11-07T05:18:44+00:00","modified_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17333:2036","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:15:25+00:00","modified_at":"2026-11-07T06:15:25+00:00","first_seen_at":"2026-11-07T06:15:25+00:00","fetched_at":"2026-11-07T06:15:25+00:00","note":"IBM bulletins (-41 for 10.0.8.13, -39 for v12.1.1.3) list CVE-2026-17333, CWE-295, CVSS 8.0 AV:A; workarounds None. No exploitation or PoC seen (not searched on X). Offseq claimed no fix; IBM says fixed.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}