IBM API Connect 10.0.8.x Hardcoded Key Credential Decryption
CVE-2026-19124 Published on November 7, 2026
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained.
Vulnerability Analysis
CVE-2026-19124 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Use of Hard-coded Credentials
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Products Associated with CVE-2026-19124
Want to know whenever a new CVE is published for IBM Api Connect? stack.watch will email you.
Affected Versions
IBM API Connect:- Version 10.0.8.0, <= 10.0.8.12 is affected.