Multiple Vulnerabilities in IBM API Connect

IBM API Connect2026-11-07 04:33 UTC1 min readRead in

Summary

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

Remediation

Inventory every IBM API Connect deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7295635

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

Version	Fixed in
12.1.0.0 – 12.1.1.2	None yet

Weakness

CWE-918

Timeline

2026-11-07Publicly disclosed

Sources

CVE · NVD