Skip to content

Exploited: 179

LatestCVE-2026-18836 — Multiple Vulnerabilities in IBM API Connect

9.8

CVE-2026-17362Fix available

Multiple Vulnerabilities in IBM API Connect

IBM API Connect V12 OnPrem2026-11-07 03:25 UTC1 min readRead in

Summary

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

Remediation

Inventory every IBM API Connect V12 OnPrem deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7295635

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
12.1.0.0 – 12.1.1.2	None yet

Weakness

CWE-862

Timeline

2026-11-07Publicly disclosed

Sources

CVE · NVD