{"id":"CVE-2026-17337","kind":"vulnerability","aliases":["CVE-2026-17337"],"related":[],"title":"IBM API Connect: improper certificate check lets authenticated attacker bypass authentication","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 does not perform a certificate check reliably in all cases, so a connection may be accepted without proper authentication. IBM fixed it in v12.1.1.3 and lists no workarounds.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","runtime","self-hosted"],"not_affected_if":["versions-outside-12.1.0.0-to-12.1.1.2"],"how_to_check":"Check your API Connect V12 on-prem version. Exposed if it is between v12.1.0.0 and v12.1.1.2 inclusive; v12.1.1.3 or later is fixed. IBM's bulletin does not name a specific certificate configuration.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)","status":"open","published_at":"2026-11-07T05:18:44+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:52:09+00:00","updated_at":"2026-11-07T06:15:26+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-07T05:52:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: improper certificate check lets authenticated attacker bypass authentication","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 do not reliably check certificates in all cases, so a connection can be accepted without proper authentication. A remote attacker who already has valid credentials could bypass authentication.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker bypasses authentication and reaches protected API management functions","analyst_note":"Find IBM's security bulletin for CVE-2026-17337 to confirm the fixed version and which certificate configuration is affected.","how_to_check":"- Check the installed IBM API Connect version against the affected range 12.1.0.0 through 12.1.1.2\n- unknown for other checks: the sources do not say which configuration or endpoint is involved","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-12.1.0.0-to-12.1.1.2"],"who_is_affected":"Teams that run IBM API Connect 12.1.0.0 through 12.1.1.2 and expose its authentication path to remote clients. The sources do not say which deployment mode or certificate configuration is required, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4227,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17337 to confirm the fixed version and which certificate configuration is affected.","search":"'-17337':14A,17A '-2026':13A,16A '12.1.0.0':73C '12.1.1.2':75C 'accept':57B,107C 'allow':77C,102C 'api':2A,19A,24B,28B,35B,71C 'api-gateway':23B 'attack':9A,81C 'authent':8A,11A,60B,80C,84C,110C 'bypass':10A,83C 'case':51B,99C 'certif':5A,46B,88C,91C 'check':6A,47B,92C 'connect':3A,20A,29B,36B,54B,72C,104C 'could':76C,101C 'cve':12A,15A 'due':85C 'fix':62B 'gateway':25B 'host':33B 'ibm':1A,18A,27B,34B,61B,70C 'ibm-api-connect':26B 'improp':4A,87C 'let':7A 'list':67B 'may':55B 'onprem':22A,38B 'perform':44B,95C 'proper':59B,109C 'reliabl':48B,96C 'remot':79C 'runtim':30B 'self':32B 'self-host':31B 'v12':21A,37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':65B 'valid':89C 'without':58B,108C 'workaround':69B","nicknames":[],"mitigations":[],"who_affected":"Self-managed (on-prem) IBM API Connect V12 deployments running v12.1.0.0 through v12.1.1.2. A certificate check is not performed reliably in all cases, so a connection may be accepted without proper authentication. IBM's bulletin lists only API Connect V12 OnPrem; other editions and versions are not listed as affected. IBM does not state a required configuration.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:15:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2034},"products":{"at":"2026-11-07T06:15:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2034},"workarounds":{"at":"2026-11-07T06:15:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2034},"how_to_check":{"at":"2026-11-07T06:15:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2034},"who_affected":{"at":"2026-11-07T06:15:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":2034}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","high","ibmapiconnect","runtime","selfhosted"],"campaign_type":null,"search_a":"'-17337':14A,17A '-2026':13A,16A 'api':2A,19A 'attack':9A 'authent':8A,11A 'bypass':10A 'certif':5A 'check':6A 'connect':3A,20A 'cve':12A,15A 'ibm':1A,18A 'improp':4A 'let':7A 'onprem':22A 'v12':21A","search_b":"'accept':57B 'api':24B,28B,35B 'api-gateway':23B 'authent':60B 'case':51B 'certif':46B 'check':47B 'connect':29B,36B,54B 'fix':62B 'gateway':25B 'host':33B 'ibm':27B,34B,61B 'ibm-api-connect':26B 'list':67B 'may':55B 'onprem':38B 'perform':44B 'proper':59B 'reliabl':48B 'runtim':30B 'self':32B 'self-host':31B 'v12':37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':65B 'without':58B 'workaround':69B","search_c":"'12.1.0.0':73C '12.1.1.2':75C 'accept':107C 'allow':77C,102C 'api':71C 'attack':81C 'authent':80C,84C,110C 'bypass':83C 'case':99C 'certif':88C,91C 'check':92C 'connect':72C,104C 'could':76C,101C 'due':85C 'ibm':70C 'improp':87C 'perform':95C 'proper':109C 'reliabl':96C 'remot':79C 'valid':89C 'without':108C","first_public_at":"2026-11-07T05:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17337","severity":null,"published_at":"2026-11-07T05:18:44+00:00","modified_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17337:2034","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T06:15:26+00:00","modified_at":"2026-11-07T06:15:26+00:00","first_seen_at":"2026-11-07T06:15:26+00:00","fetched_at":"2026-11-07T06:15:26+00:00","note":"Read IBM bulletin node/7295635 (fixed v12.1.1.3, affected V12 OnPrem 12.1.0.0-12.1.1.2, workarounds: None). Bulletin CWE-362 mismatches the description (certificate validation); CVSS vector says PR:N while text says authenticated. No exploitation or PoC found; did not search social posts. Part of a multi-CVE bulletin.","cites":["https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}