API CONNECT V12 ONPREM · CVE-2026-17360 · Vendor
FIX → 12.1.1.3 ✓ verified
IBM API Connect versions 12.1.0.0 through 12.1.1.2 ship with hard-coded credentials. A remote attacker who knows or finds those credentials can log in with full administrative control.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted (on-prem) IBM API Connect V12, versions v12.1.0.0 through v12.1.1.2, are exposed. IBM rates it CVSS 9.8: network-reachable, no authentication, no user interaction, so any reachable management endpoint is at risk. Teams on other versions or not running on-prem V12 can skip it. IBM lists no workaround, so upgrading is the remedy.
Not affected if version-outside-range
Who cares api-gateway, ibm-api-connect, self-hosted
v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 or later contains the fixIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 12.1.1.3
Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205)