4.1
Medium
CVE-2026-17085 Multiple Vulnerabilities in IBM API Connect
Description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| API Connect 12.1 | 12.1.0.0 → 12.1.1.2 | No fix stated |
| API Connect 10.0 | 10.0.8.0 → 10.0.8.12 | No fix stated |