Vulnerability record/PUBLISHED/Published Nov 7, 2026 04:33:04 UTC
CVE-2026-17312
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
Base score5.4/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityibm
Last updatedNov 7, 2026 04:33:04 UTC
PublishedNov 7, 2026 04:33:04 UTC
ReservedJul 25, 2026 01:28:32 UTC