{"id":"CVE-2026-17377","kind":"vulnerability","aliases":["CVE-2026-17377"],"related":[],"title":"IBM API Connect: authenticated users can forge audit log records","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize output written to logs. A remote attacker with a valid account can forge audit records, hiding or faking activity.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-management","ibm-api-connect","infrastructure"],"not_affected_if":["no-authenticated-users","unaffected-version"],"how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Review the API Connect release notes or IBM security bulletin for the product in use: unknown if the sources name the exact check.","fix":null,"status":"open","published_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:54:17+00:00","updated_at":"2026-11-07T05:54:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:54:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated users can forge audit log records","impact":"low","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize output written to logs. A remote attacker with a valid account can forge audit records, hiding or faking activity.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"audit trail can be falsified by an authenticated user","analyst_note":"Check the IBM security bulletin for the fixed versions and any mitigation for CVE-2026-17377; the NVD entry alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Review the API Connect release notes or IBM security bulletin for the product in use: unknown if the sources name the exact check.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-users"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where users with an account can submit input that ends up in audit logs. Teams on other versions, or without API Connect, are not affected by this entry.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4226,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-17377':13A,16A '-2026':12A,15A '10.0.8.0':29B,61C '10.0.8.12':31B,63C '12.1.0.0':33B,65C '12.1.1.2':35B,67C 'account':49B 'activ':57B 'allow':69C 'api':2A,18B,22B,26B,59C 'api-manag':17B 'attack':45B,73C 'audit':8A,52B,76C 'authent':4A,72C 'connect':3A,23B,27B,60C 'could':68C 'cve':11A,14A 'due':78C 'fake':56B 'forg':7A,51B,75C 'hide':54B 'ibm':1A,21B,25B,58C 'ibm-api-connect':20B 'improp':80C 'infrastructur':24B 'log':9A,42B,84C 'manag':19B 'neutral':38B,82C 'output':39B,81C 'record':10A,53B,77C 'remot':44B,71C 'user':5A 'valid':48B 'version':28B 'written':40B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected version ranges, where users with an account can submit input that ends up in audit logs. Teams on other versions, or without API Connect, are not affected by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apimanagement","ibmapiconnect","infrastructure","medium"],"campaign_type":null,"search_a":"'-17377':13A,16A '-2026':12A,15A 'api':2A 'audit':8A 'authent':4A 'connect':3A 'cve':11A,14A 'forg':7A 'ibm':1A 'log':9A 'record':10A 'user':5A","search_b":"'10.0.8.0':29B '10.0.8.12':31B '12.1.0.0':33B '12.1.1.2':35B 'account':49B 'activ':57B 'api':18B,22B,26B 'api-manag':17B 'attack':45B 'audit':52B 'connect':23B,27B 'fake':56B 'forg':51B 'hide':54B 'ibm':21B,25B 'ibm-api-connect':20B 'infrastructur':24B 'log':42B 'manag':19B 'neutral':38B 'output':39B 'record':53B 'remot':44B 'valid':48B 'version':28B 'written':40B","search_c":"'10.0.8.0':61C '10.0.8.12':63C '12.1.0.0':65C '12.1.1.2':67C 'allow':69C 'api':59C 'attack':73C 'audit':76C 'authent':72C 'connect':60C 'could':68C 'due':78C 'forg':75C 'ibm':58C 'improp':80C 'log':84C 'neutral':82C 'output':81C 'record':77C 'remot':71C","first_public_at":"2026-11-07T05:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17377","severity":null,"published_at":"2026-11-07T05:18:51+00:00","modified_at":"2026-11-07T05:18:51+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}