Multiple Vulnerabilities in IBM API Connect

IBM API Connect2026-11-07 04:40 UTC1 min readRead in

Summary

IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

Remediation

Inventory every IBM API Connect deployment, including staging.
No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

Patchhttps://www.ibm.com/support/pages/node/7295637

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

Version	Fixed in
10.0.8.0 – 10.0.8.12	None yet

Weakness

CWE-918

Timeline

2026-11-07Publicly disclosed

Sources

CVE · NVD