Vulnerability record/PUBLISHED/Published Nov 7, 2026 04:34:37 UTC
CVE-2026-17428
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
Base score5.0/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityibm
Last updatedNov 8, 2026 01:49:37 UTC
PublishedNov 7, 2026 04:34:37 UTC
ReservedJul 25, 2026 06:19:46 UTC