{"id":"CVE-2026-17386","kind":"vulnerability","aliases":["CVE-2026-17386"],"related":[],"title":"IBM API Connect: weak random number generator lets remote attackers gain admin","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 use a cryptographically weak pseudo-random number generator. A remote attacker can exploit this to gain full administrative control of the product.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the installed IBM API Connect version and check whether it falls within `10.0.8.0` through `10.0.8.12`.","fix":"- IBM API Connect `10.0.8.0` through `10.0.8.12`: the sources do not name a fixed version.","status":"open","published_at":"2026-11-07T05:18:52+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","triaged_at":"2026-11-07T05:50:27+00:00","updated_at":"2026-11-07T05:50:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-07T05:50:27Z","model":"claude-haiku-5-5","output":{"fix":"- IBM API Connect `10.0.8.0` through `10.0.8.12`: the sources do not name a fixed version.","reach":"internet","title":"IBM API Connect: weak random number generator lets remote attackers gain admin","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 use a cryptographically weak pseudo-random number generator. A remote attacker can exploit this to gain full administrative control of the product.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker gains full administrative control of the API Connect system","analyst_note":"Find IBM's security bulletin for CVE-2026-17386 to confirm the fixed version, the affected components and whether authentication is required.","how_to_check":"- Confirm the installed IBM API Connect version and check whether it falls within `10.0.8.0` through `10.0.8.12`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the affected 10.0.8.x range are exposed. The sources do not say which deployment configurations are involved or whether the flaw is reachable without an account, so check with IBM's advisory before deciding how urgent it is.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4199,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-17386':15A,18A '-2026':14A,17A '10.0.8.0':31B,60C '10.0.8.12':33B,62C 'admin':12A 'administr':52B,71C 'allow':64C 'api':2A,20B,24B,28B,58C 'api-gateway':19B 'attack':10A,45B,67C 'connect':3A,25B,29B,59C 'control':53B,72C 'could':63C 'cryptograph':36B,79C 'cve':13A,16A 'due':73C 'exploit':47B 'full':51B,70C 'gain':11A,50B,69C 'gateway':21B 'generat':7A,42B,85C 'ibm':1A,23B,27B,57C 'ibm-api-connect':22B 'infrastructur':26B 'let':8A 'number':6A,41B,84C 'product':56B 'pseudo':39B,82C 'pseudo-random':38B,81C 'random':5A,40B,83C 'remot':9A,44B,66C 'use':34B,76C 'version':30B 'weak':4A,37B,80C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect in the affected 10.0.8.x range are exposed. The sources do not say which deployment configurations are involved or whether the flaw is reachable without an account, so check with IBM's advisory before deciding how urgent it is.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apigateway","high","ibmapiconnect","infrastructure"],"campaign_type":null,"search_a":"'-17386':15A,18A '-2026':14A,17A 'admin':12A 'api':2A 'attack':10A 'connect':3A 'cve':13A,16A 'gain':11A 'generat':7A 'ibm':1A 'let':8A 'number':6A 'random':5A 'remot':9A 'weak':4A","search_b":"'10.0.8.0':31B '10.0.8.12':33B 'administr':52B 'api':20B,24B,28B 'api-gateway':19B 'attack':45B 'connect':25B,29B 'control':53B 'cryptograph':36B 'exploit':47B 'full':51B 'gain':50B 'gateway':21B 'generat':42B 'ibm':23B,27B 'ibm-api-connect':22B 'infrastructur':26B 'number':41B 'product':56B 'pseudo':39B 'pseudo-random':38B 'random':40B 'remot':44B 'use':34B 'version':30B 'weak':37B","search_c":"'10.0.8.0':60C '10.0.8.12':62C 'administr':71C 'allow':64C 'api':58C 'attack':67C 'connect':59C 'control':72C 'could':63C 'cryptograph':79C 'due':73C 'full':70C 'gain':69C 'generat':85C 'ibm':57C 'number':84C 'pseudo':82C 'pseudo-random':81C 'random':83C 'remot':66C 'use':76C 'weak':80C","first_public_at":"2026-11-07T05:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17386","severity":null,"published_at":"2026-11-07T05:18:52+00:00","modified_at":"2026-11-07T05:18:53+00:00","first_seen_at":"2026-11-07T05:46:06+00:00","fetched_at":"2026-11-07T05:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}