{"id":"CVE-2026-17394","kind":"vulnerability","aliases":["CVE-2026-17394"],"related":[],"title":"IBM API Connect: authenticated user can change access setting and expose data","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user supply a value that changes an access-related setting the system should control. An attacker can use this to read sensitive information they should not see.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Find your API Connect version (Cloud Manager or API Manager UI, or your installation's version info). You are exposed if it is 10.0.8.0 through 10.0.8.12, or 12.1.0.0 through 12.1.1.2 (V12 OnPrem). 10.0.8.13 and 12.1.1.3 or later are fixed.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, and 12.1.x to 12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205 for 12.1.1.3). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:54+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:27+00:00","updated_at":"2026-11-07T05:52:12+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:48:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated user can change access setting and expose data","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user supply a value that changes an access-related setting the system should control. An attacker can use this to read sensitive information they should not see.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information readable by an authenticated remote attacker","analyst_note":"Find IBM's security bulletin for CVE-2026-17394 to confirm the fixed versions and any configuration that limits exposure; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-17394 gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users hold accounts. The sources do not describe the specific configuration needed to reach the flaw, so exposure beyond the version range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":4267,"output_tokens":574,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17394 to confirm the fixed versions and any configuration that limits exposure; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-17394 gives no fix.","search":"'-17394':15A,18A '-2026':14A,17A '10.0.8.0':43B,86C '10.0.8.12':45B,88C '12.1.0.0':47B,90C '12.1.1.2':49B,92C 'access':8A,63B,120C 'access-rel':62B,119C 'allow':94C 'api':2A,19A,21A,26B,33B,40B,84C 'api-gateway':25B 'attack':71B,98C 'attribut':110C 'auth':29B 'auth-requir':28B 'authent':4A,97C 'chang':7A,60B,117C 'connect':3A,20A,22A,34B,41B,85C 'control':69B,106C,126C 'could':93C,116C,131C 'cve':13A,16A 'data':12A 'due':103C 'expos':11A,132C 'gateway':27B 'host':37B 'ibm':1A,32B,39B,83C 'ibm-api-connect':31B 'improp':105C 'inform':78B,102C,134C 'let':50B 'log':53B 'logged-in':52B 'modif':107C 'object':109C 'obtain':100C 'onprem':24A 'read':76B 'relat':64B,121C 'remot':96C 'requir':30B 'see':82B 'self':36B 'self-host':35B 'sensit':77B,101C,133C 'set':9A,65B,122C 'suppli':56B,114C 'system':67B,129C 'use':73B 'user':5A,55B,113C 'user-suppli':112C 'v12':23A 'valu':58B,115C 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM API Connect themselves (on-premises or self-managed) on 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. Any logged-in user can supply a value that changes an access-related setting the system should control, which can expose sensitive information; IBM rates it 9.6 with scope change. Teams on 10.0.8.13 or 12.1.1.3 and later can skip it; IBM's bulletins list no workaround, so upgrading is the only listed remedy.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:52:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1967},"products":{"at":"2026-11-07T05:52:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1967},"workarounds":{"at":"2026-11-07T05:52:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1967},"how_to_check":{"at":"2026-11-07T05:52:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1967},"who_affected":{"at":"2026-11-07T05:52:12Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1967}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17394':15A,18A '-2026':14A,17A 'access':8A 'api':2A,19A,21A 'authent':4A 'chang':7A 'connect':3A,20A,22A 'cve':13A,16A 'data':12A 'expos':11A 'ibm':1A 'onprem':24A 'set':9A 'user':5A 'v12':23A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'access':63B 'access-rel':62B 'api':26B,33B,40B 'api-gateway':25B 'attack':71B 'auth':29B 'auth-requir':28B 'chang':60B 'connect':34B,41B 'control':69B 'gateway':27B 'host':37B 'ibm':32B,39B 'ibm-api-connect':31B 'inform':78B 'let':50B 'log':53B 'logged-in':52B 'read':76B 'relat':64B 'requir':30B 'see':82B 'self':36B 'self-host':35B 'sensit':77B 'set':65B 'suppli':56B 'system':67B 'use':73B 'user':55B 'valu':58B 'vendor':38B 'version':42B","search_c":"'10.0.8.0':86C '10.0.8.12':88C '12.1.0.0':90C '12.1.1.2':92C 'access':120C 'access-rel':119C 'allow':94C 'api':84C 'attack':98C 'attribut':110C 'authent':97C 'chang':117C 'connect':85C 'control':106C,126C 'could':93C,116C,131C 'due':103C 'expos':132C 'ibm':83C 'improp':105C 'inform':102C,134C 'modif':107C 'object':109C 'obtain':100C 'relat':121C 'remot':96C 'sensit':101C,133C 'set':122C 'suppli':114C 'system':129C 'user':113C 'user-suppli':112C 'valu':115C","first_public_at":"2026-11-07T05:18:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17394","severity":null,"published_at":"2026-11-07T05:18:54+00:00","modified_at":"2026-11-07T05:18:54+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17394:1967","url":"https://www.ibm.com/support/pages/node/7295637","severity":null,"published_at":"2026-11-07T05:52:12+00:00","modified_at":"2026-11-07T05:52:12+00:00","first_seen_at":"2026-11-07T05:52:12+00:00","fetched_at":"2026-11-07T05:52:12+00:00","note":"Read both IBM bulletins (node/7295637 for 10.0.8.x, security-bulletin-...-39 for 12.1.x); both list CVE-2026-17394, CVSS 9.6 (AV:N/PR:L/S:C), CWE-915. Fix 10.0.8.13 / 12.1.1.3; workarounds: None. Exploitation/PoC and social posts not searched.","cites":["https://www.ibm.com/support/pages/node/7295637","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93164,"url":"https://www.ibm.com/support/pages/node/7295637","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}