Critical severity threats

CVE-2026-17359 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by influencing the code generation process through user-supplied input. This vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17354 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file writes, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-17353 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and obtain sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without availability impact.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to cause the service to send requests to unintended destinations. This vulnerability can be exploited without authentication and may lead to the exposure of sensitive information.

CVE-2026-17342 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation.

A critical path traversal vulnerability (CWE-22) exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to execute arbitrary code on the affected system without any privileges or user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17339 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access or delete resources belonging to other tenants. This vulnerability arises from improper validation of file paths, enabling unauthorized cross-tenant resource manipulation.

CVE-2026-17338 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves broken object-level authorization that could allow a remote authenticated attacker to access sensitive information. The flaw is due to authorization bypass through a user-controlled key.

CVE-2026-17336 is a critical SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-17329 is a critical Server-Side Request Forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs.

CVE-2026-17313 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass authentication via an alternate path, potentially obtaining sensitive information and gaining control over gateway configuration.

CVE-2026-17301 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of a cryptographic signature, which could allow an unauthenticated attacker to bypass authentication controls.

CVE-2026-17299 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file reads and SSRF by exploiting insufficient restrictions on externally referenced content in submitted definitions. The vulnerability arises from unrestricted resolution of external references, which can lead to sensitive content being retrieved and returned to the attacker.

CVE-2026-17298 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a CVSS score of 9.9, indicating a high impact on confidentiality, integrity, and availability.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. This flaw allows a remote attacker to manipulate the redirect address during sign-in, which is not properly validated. Exploiting this could lead to an account takeover by redirecting authentication results to an attacker-controlled location.

CVE-2026-17296 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without affecting availability.

CVE-2026-17292 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls and take over ownership of organizations they do not control due to incomplete access checks on organization objects.

CVE-2026-17278 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data by exploiting insufficient verification of client-supplied information. This enables the attacker to impersonate a trusted party without proper authentication.

A path traversal vulnerability (CWE-22) exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote authenticated attacker to execute arbitrary code on the affected system. The vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-17158 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to gain elevated privileges, potentially compromising confidentiality, integrity, and availability of the affected system.