{"id":"CVE-2026-17409","kind":"vulnerability","aliases":["CVE-2026-17409"],"related":[],"title":"IBM API Connect: case-sensitivity flaw lets remote attackers run admin operations","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 apply access controls inconsistently across variations of a request, because of case-sensitivity handling. A remote attacker can reach restricted administrative operations and obtain sensitive information.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect v12","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"Check the installed API Connect version (management, gateway, portal and analytics subsystems). You are exposed on 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2; 10.0.8.13 and 12.1.1.3 or later are fixed.","fix":"Upgrade to API Connect 10.0.8.13 (for 10.0.8.0-10.0.8.12) or 12.1.1.3 (for 12.1.0.0-12.1.1.2), downloaded from IBM Fix Central. IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:48:34+00:00","updated_at":"2026-11-07T05:49:54+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: case-sensitivity flaw lets remote attackers run admin operations","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 apply access controls inconsistently across variations of a request, because of case-sensitivity handling. A remote attacker can reach restricted administrative operations and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker runs restricted admin operations and reads sensitive information","analyst_note":"Find IBM's security bulletin for CVE-2026-17409 to confirm the fixed version and whether authentication is required.","how_to_check":"- Check the installed API Connect version against `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed when its management or gateway endpoints are reachable from the network. The sources do not say which deployment roles or configurations are most exposed. Teams on other versions or other IBM products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000711,"input_tokens":4271,"output_tokens":567,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17409 to confirm the fixed version and whether authentication is required.","search":"'-17409':16A,19A '-2026':15A,18A '10.0.8.0':40B,77C '10.0.8.12':42B,79C '12.1.0.0':44B,81C '12.1.1.2':46B,83C 'access':48B,105C 'across':51B 'admin':12A 'administr':68B,92C 'allow':85C,119C 'api':2A,20A,22A,26B,30B,37B,75C 'api-gateway':25B 'appli':47B,109C 'attack':10A,64B,88C 'case':5A,59B,103C 'case-sensit':4A,58B 'connect':3A,21A,23A,31B,38B,76C 'consist':110C 'control':49B,106C 'could':84C,118C 'cve':14A,17A 'due':98C 'execut':90C 'flaw':7A 'gateway':27B 'handl':61B,101C 'host':35B 'ibm':1A,29B,36B,74C 'ibm-api-connect':28B 'improp':100C 'inconsist':50B 'inform':73B,97C 'infrastructur':32B 'let':8A 'obtain':71B,95C 'oper':13A,69B,93C,121C 'reach':66B,124C 'remot':9A,63B,87C 'request':55B,116C 'restrict':67B,120C 'run':11A 'self':34B 'self-host':33B 'sensit':6A,60B,72B,96C,104C 'unauthor':91C 'v12':24A 'variat':52B,113C 'version':39B","nicknames":[],"mitigations":[],"who_affected":"Anyone running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or 12.1.0.0 to 12.1.1.2 is exposed. IBM's CVSS vector says a remote attacker needs no login (network, low complexity, no privileges), so any instance whose endpoints can be reached over the network is at risk. Teams on 10.0.8.13, 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:49:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1963},"workarounds":{"at":"2026-11-07T05:49:54Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7290205","run_id":1963}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12","connect","connectv12"],"ptokens":["api","connect","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17409':16A,19A '-2026':15A,18A 'admin':12A 'api':2A,20A,22A 'attack':10A 'case':5A 'case-sensit':4A 'connect':3A,21A,23A 'cve':14A,17A 'flaw':7A 'ibm':1A 'let':8A 'oper':13A 'remot':9A 'run':11A 'sensit':6A 'v12':24A","search_b":"'10.0.8.0':40B '10.0.8.12':42B '12.1.0.0':44B '12.1.1.2':46B 'access':48B 'across':51B 'administr':68B 'api':26B,30B,37B 'api-gateway':25B 'appli':47B 'attack':64B 'case':59B 'case-sensit':58B 'connect':31B,38B 'control':49B 'gateway':27B 'handl':61B 'host':35B 'ibm':29B,36B 'ibm-api-connect':28B 'inconsist':50B 'inform':73B 'infrastructur':32B 'obtain':71B 'oper':69B 'reach':66B 'remot':63B 'request':55B 'restrict':67B 'self':34B 'self-host':33B 'sensit':60B,72B 'variat':52B 'version':39B","search_c":"'10.0.8.0':77C '10.0.8.12':79C '12.1.0.0':81C '12.1.1.2':83C 'access':105C 'administr':92C 'allow':85C,119C 'api':75C 'appli':109C 'attack':88C 'case':103C 'connect':76C 'consist':110C 'control':106C 'could':84C,118C 'due':98C 'execut':90C 'handl':101C 'ibm':74C 'improp':100C 'inform':97C 'obtain':95C 'oper':93C,121C 'reach':124C 'remot':87C 'request':116C 'restrict':120C 'sensit':96C,104C 'unauthor':91C 'variat':113C","first_public_at":"2026-11-07T05:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17409","severity":null,"published_at":"2026-11-07T05:18:58+00:00","modified_at":"2026-11-07T05:18:58+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17409:1963","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:49:54+00:00","modified_at":"2026-11-07T05:49:54+00:00","first_seen_at":"2026-11-07T05:49:54+00:00","fetched_at":"2026-11-07T05:49:54+00:00","note":"IBM bulletins read: 10.0.8.13 bulletin (-41) and 12.1.1.3 bulletin (-39) both list CVE-2026-17409 (CWE-178, CVSS 9.4, AV:N/PR:N so no authentication needed). Workarounds: None (stated in 10.0.8.13 bulletin). No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/node/7290205"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93155,"url":"https://www.ibm.com/support/pages/node/7290205","title":"IBM API Connect v12.1.1.3 is now available","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}