IBM API Connect 10.0.8.12/12.1.1.2 Backup Server MITM via identity check flaw
CVE-2026-19129 Published on November 7, 2026
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.
Vulnerability Analysis
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2026-19129
Want to know whenever a new CVE is published for IBM Api Connect? stack.watch will email you.
Affected Versions
IBM API Connect:- Version 12.1.0.0, <= 12.1.1.2 is affected.
- Version 10.0.8.0, <= 10.0.8.12 is affected.