Do Son 
TL;DR
IBM has disclosed 208 security flaws in its API Connect platform, with CVE records published on November 7, 2026. Of these IBM API Connect vulnerabilities, 47 are rated critical and 94 high. Several allow remote code execution or authentication bypass without any login.
API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain flaws that score up to CVSS 9.9. Unauthenticated attackers could bypass logins, run commands or seize admin control through hard-coded credentials. IBM also fixed a separate 9.8-rated flaw in Aspera Faspex.
- Total: 9 CVEs
- Severity: 9 Critical
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-17402
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-17402 | 9.9 | CWE-78 | Not exploited |
| CVE-2026-17392 | 9.9 | CWE-90 | Not exploited |
| CVE-2026-17410 | 9.9 | CWE-88 | Not exploited |
| CVE-2026-17301 | 9.8 | CWE-347 | Not exploited |
| CVE-2026-17408 | 9.8 | CWE-78 | Not exploited |
| CVE-2026-17360 | 9.8 | CWE-798 | Not exploited |
| CVE-2026-17340 | 9.8 | CWE-22 | Not exploited |
| CVE-2026-17313 | 9.8 | CWE-288 | Not exploited |
Why It Matters
API Connect manages and secures APIs for large organizations. So a breach can expose gateway settings, tenant data and internal networks. Many of the bugs also cross tenant boundaries in shared deployments.
So far, no exploitation in the wild has been confirmed. OffSeq reports no public exploit code and no attack traffic for at least one of the flaws.
Moreover, the sheer volume is unusual. A single product release with more than 200 CVEs gives defenders a long list to triage.
By the numbers
- Critical: 47
- High: 94
- Medium: 64
- Low: 3
- Most common type: server-side request forgery, with about 40 entries
How the Attacks Work
No login required
CVE-2026-17301 (CVSS 9.8) could allow “an unauthenticated attacker to bypass authentication.” The cause is improper verification of a cryptographic signature. Similarly, CVE-2026-17360 grants “full administrative control due to the use of hard-coded credentials.” Other 9.8-rated bugs, CVE-2026-17408 and CVE-2026-17340, allow code execution through OS command injection and path traversal. Meanwhile, CVE-2026-17313 lets attackers “take control of gateway configuration.”
Authenticated attacks
A second group, rated 9.9, needs a valid account. For example, CVE-2026-17402 allows OS command injection. In addition, CVE-2026-17392 uses LDAP injection to gain admin access to other tenants. CVE-2026-17410 lets users “access and modify other tenants’ portal data.”
Aspera Faspex
Separately, CVE-2026-123218 affects Aspera Faspex 5.0.0 through 5.0.19. It could let a user craft a message to “gain full administrative privileges.”
Affected Versions
- IBM API Connect 10.0.8.0 through 10.0.8.12
- IBM API Connect 12.1.0.0 through 12.1.1.2
- IBM Aspera Faspex 5.0.0 through 5.0.19
Most of the IBM API Connect vulnerabilities hit both branches. However, 73 affect only the 12.1 line.
Patch and Mitigation
- Apply the fixes in IBM’s security bulletins for API Connect and Aspera Faspex.
- Restrict management and gateway interfaces to trusted networks until you patch.
- Limit outbound traffic from API Connect hosts to reduce SSRF risk.
- Review tenant and admin accounts for changes you did not make.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
