---
id: "CVE-2026-17394"
page: "https://infrastack.ai/live/CVE-2026-17394"
kind: "vulnerability"
aliases: ["CVE-2026-17394"]
title: "IBM API Connect: authenticated user can change access setting and expose data"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "API Connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "API Connect V12 OnPrem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "auth-required", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-07T05:18:54+00:00"
first_seen_at: "2026-11-07T05:46:07+00:00"
updated_at: "2026-11-07T05:52:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17394", "first_seen_at": "2026-11-07T05:46:07+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/node/7295637", "first_seen_at": "2026-11-07T05:52:12+00:00", "cites": ["https://www.ibm.com/support/pages/node/7295637", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "https://www.ibm.com/support/pages/node/7290205"]}]
exploit_sources: []
---

# IBM API Connect: authenticated user can change access setting and expose data

Link for people: https://infrastack.ai/live/CVE-2026-17394 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user supply a value that changes an access-related setting the system should control. An attacker can use this to read sensitive information they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:API Connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:API Connect V12 OnPrem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Find your API Connect version (Cloud Manager or API Manager UI, or your installation's version info). You are exposed if it is 10.0.8.0 through 10.0.8.12, or 12.1.0.0 through 12.1.1.2 (V12 OnPrem). 10.0.8.13 and 12.1.1.3 or later are fixed.

## Fix

Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, and 12.1.x to 12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205 for 12.1.1.3). IBM lists no workaround.

## Timeline

- 2026-11-07T05:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17394
- 2026-11-07T05:52:12+00:00 analyst https://www.ibm.com/support/pages/node/7295637 — Read both IBM bulletins (node/7295637 for 10.0.8.x, security-bulletin-...-39 for 12.1.x); both list CVE-2026-17394, CVSS 9.6 (AV:N/PR:L/S:C), CWE-915. Fix 10.0.8.13 / 12.1.1.3; workarounds: None. Exploitation/PoC and social posts not searched.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/node/7295637
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39
- [fix] IBM API Connect v12.1.1.3 is now available https://www.ibm.com/support/pages/node/7290205

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_