IBM API Connect <=10.0.8.12, <=12.1.1.2 Auth Bypass via Sig Verification
CVE-2026-17379 Published on November 7, 2026

Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.

Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-17379 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.


Products Associated with CVE-2026-17379

Want to know whenever a new CVE is published for IBM Api Connect? stack.watch will email you.

IBM Api Connect

Affected Versions

IBM API Connect: