{"id":"CVE-2026-17362","kind":"vulnerability","aliases":["CVE-2026-17362"],"related":[],"title":"IBM API Connect: remote attacker can create, change or delete tenants","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 is missing an authorization check (CWE-862, CVSS 9.8, no authentication required), so a remote attacker can create, modify or delete tenants. IBM fixed it in v12.1.1.3 in a bulletin covering many other API Connect CVEs. IBM lists no workaround.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check the installed API Connect V12 OnPrem version (management console or deployment). Versions v12.1.0.0 through v12.1.1.2 are affected; v12.1.1.3 contains the fix.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround or interim mitigation.","status":"open","published_at":"2026-11-07T04:17:29+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:49+00:00","updated_at":"2026-11-07T04:49:22+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T04:47:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: remote attacker can create, change or delete tenants","impact":"high","summary":"IBM API Connect 12.1.0.0 through 12.1.1.2 is missing an authorization check, so a remote attacker can create, modify or delete tenants. Tenant changes affect every API and user inside the affected tenant.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker deletes or rewrites tenants and their API configuration","analyst_note":"Find IBM's security bulletin for CVE-2026-17362 to get the fixed version and any required interim settings; NVD alone gives only the affected range.","how_to_check":"- Check the installed API Connect version in the management console or deployment, and see whether it falls within `12.1.0.0` through `12.1.1.2`.\n- unknown for any other check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run IBM API Connect 12.1.0.0 through 12.1.1.2 with tenant management reachable over the network. The sources do not say which deployment modes or configurations are exposed, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000683,"input_tokens":4193,"output_tokens":527,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17362 to get the fixed version and any required interim settings; NVD alone gives only the affected range.","search":"'-17362':14A,17A '-2026':13A,16A '-862':47B '12.1.0.0':84C '12.1.1.2':86C '9.8':49B 'allow':88C 'api':2A,18A,23B,27B,34B,74B,82C 'api-gateway':22B 'attack':5A,56B,91C 'authent':51B 'author':44B,101C 'bulletin':70B 'chang':8A 'check':45B 'connect':3A,19A,28B,35B,75B,83C 'could':87C 'cover':71B 'creat':7A,58B,93C 'cve':12A,15A 'cves':76B 'cvss':48B 'cwe':46B 'delet':10A,61B,96C 'due':98C 'fix':64B 'gateway':24B 'host':32B 'ibm':1A,26B,33B,63B,77B,81C 'ibm-api-connect':25B 'infrastructur':29B 'list':78B 'mani':72B 'miss':42B,100C 'modifi':59B,94C 'onprem':21A,37B 'remot':4A,55B,90C 'requir':52B 'self':31B 'self-host':30B 'tenant':11A,62B,97C 'v12':20A,36B 'v12.1.0.0':38B 'v12.1.1.2':40B 'v12.1.1.3':67B 'workaround':80B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 OnPrem at 12.1.0.0 through 12.1.1.2 are exposed; the flaw is reachable remotely without credentials, and tenant changes affect every API and user in the tenant. Versions at 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T04:49:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1950},"products":{"at":"2026-11-07T04:49:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1950},"workarounds":{"at":"2026-11-07T04:49:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1950},"how_to_check":{"at":"2026-11-07T04:49:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1950},"who_affected":{"at":"2026-11-07T04:49:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7295635","run_id":1950}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17362':14A,17A '-2026':13A,16A 'api':2A,18A 'attack':5A 'chang':8A 'connect':3A,19A 'creat':7A 'cve':12A,15A 'delet':10A 'ibm':1A 'onprem':21A 'remot':4A 'tenant':11A 'v12':20A","search_b":"'-862':47B '9.8':49B 'api':23B,27B,34B,74B 'api-gateway':22B 'attack':56B 'authent':51B 'author':44B 'bulletin':70B 'check':45B 'connect':28B,35B,75B 'cover':71B 'creat':58B 'cves':76B 'cvss':48B 'cwe':46B 'delet':61B 'fix':64B 'gateway':24B 'host':32B 'ibm':26B,33B,63B,77B 'ibm-api-connect':25B 'infrastructur':29B 'list':78B 'mani':72B 'miss':42B 'modifi':59B 'onprem':37B 'remot':55B 'requir':52B 'self':31B 'self-host':30B 'tenant':62B 'v12':36B 'v12.1.0.0':38B 'v12.1.1.2':40B 'v12.1.1.3':67B 'workaround':80B","search_c":"'12.1.0.0':84C '12.1.1.2':86C 'allow':88C 'api':82C 'attack':91C 'author':101C 'connect':83C 'could':87C 'creat':93C 'delet':96C 'due':98C 'ibm':81C 'miss':100C 'modifi':94C 'remot':90C 'tenant':97C","first_public_at":"2026-11-07T04:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17362","severity":null,"published_at":"2026-11-07T04:17:29+00:00","modified_at":"2026-11-07T04:17:29+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17362:1950","url":"https://www.ibm.com/support/pages/node/7295635","severity":null,"published_at":"2026-11-07T04:49:22+00:00","modified_at":"2026-11-07T04:49:22+00:00","first_seen_at":"2026-11-07T04:49:22+00:00","fetched_at":"2026-11-07T04:49:22+00:00","note":"Read IBM bulletin node/7295635 (5 Nov 2026): CVE listed, affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix upgrade to v12.1.1.3 (Fix Central node/7290205), workarounds: None. Bulletin page metadata says up to 12.1.1.3 but Affected table says 1.1.2; used the table. No exploitation or PoC found; did not search X. No vendor mitigations.","cites":["https://www.ibm.com/support/pages/node/7295635","https://www.ibm.com/support/pages/node/7295635"]}],"documents":[{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":92834,"url":"https://www.ibm.com/support/pages/node/7295635","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}