IBM API Connect 12.1.0.012.1.1.2 Auth Bypass Info Disclosure/Config Modify
CVE-2026-18838 Published on November 7, 2026

Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-18838 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
LOW

Weakness Type

Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.


Products Associated with CVE-2026-18838

Want to know whenever a new CVE is published for IBM Api Connect? stack.watch will email you.

IBM Api Connect

Affected Versions

IBM API Connect: