Introduction
A credential baked into IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote attacker with no prior privileges take full administrative control of the platform that organizations use to publish, secure and govern their APIs. IBM rates the issue CVSS 3.1 9.8 (Critical), and the only remediation it documents is an upgrade to API Connect 12.1.1.3.
IBM API Connect is IBM's platform for managing and securing APIs across their lifecycle. Its API Manager component organizes, publishes and analyzes APIs, controls their visibility, and delegates administrative tasks through roles and permissions. IBM states it was named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th consecutive time, which reflects analyst positioning in the API management market rather than any statement about product security. Because API Connect decides which API products exist and who can see and consume them, administrative control over it is a significant position, even though the disclosed impact is scoped to the API Connect installation itself.
Technical information
Root cause: CWE-798
The vulnerability is classified as CWE-798, Use of Hardcoded Credentials. IBM and NVD describe the consequence plainly: a remote attacker could gain full administrative control of IBM API Connect. IBM's affected product table names API Connect V12 OnPrem, releases 12.1.0.0 through 12.1.1.2.
MITRE describes an inbound variant of CWE-798 in which a product checks supplied authentication credentials against a hardcoded credential set. That is the general weakness class. IBM has not publicly identified which subsystem holds the credential or which authentication implementation checks it, and API Connect is closed source, so there is no public code to inspect.
What defines this weakness class is that the secret ships with the product. With CWE-798, the credential is almost always static and identical on every installation, which turns it into a universal key. Anyone who learns it can, in principle, reuse it against any unpatched instance. IBM has not confirmed these specifics for this CVE, so treat that as the typical behavior of the weakness class rather than a vendor statement.
What the CVSS vector tells us
IBM published the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- AV:N: network attack vector
- AC:L: low attack complexity
- PR:N: no privileges required before the attack
- UI:N: no participation from another user required
- S:U: unchanged scope
- C:H / I:H / A:H: high potential impact to confidentiality, integrity and availability
Two details matter when reading this vector. First, the FIRST CVSS 3.1 specification allows the Network category to include attacks from within a corporate intranet, so AV:N does not mean a given installation is reachable from the internet. Second, the 9.8 is IBM's CNA score; NVD currently shows its own assessment as N/A and marks the record for enrichment, so this is not an independently completed NVD score.
Attack flow
Based on the public description and the CVSS metrics, the attack model looks like this:
- The attacker has network reach to an affected API Connect V12 OnPrem instance (this may be internal network reach, not necessarily internet exposure).
- The attacker does not need an account, prior foothold or a victim to click anything (PR:N, UI:N), because the credential is part of the product rather than something an operator created.
- The attacker supplies the embedded credential to the authentication path that accepts it.
- The product grants administrative access, giving the attacker full administrative control of the API Connect installation, consistent with the C:H/I:H/A:H impact ratings.
IBM's bulletin does not disclose the credential value, where it is stored, the affected endpoint, a request sequence, a payload or a validation procedure. The disclosed outcome is administrative control of API Connect. The bulletin does not establish operating system root access or a specific downstream compromise path into connected backends. The sequence above is a model derived from the weakness class and the vector, not a reproducible exploit.
Exploitation status
As of 7 November 2026, the reviewed CVE and NVD machine-readable records contain no exploitation, SSVC or EPSS fields, and IBM provides no observed attack narrative. No threat actor or campaign can be attributed from the reviewed material.
OffSeq Threat Radar labels the issue "Detectable" and "Weaponized" and claims a public Nuclei template can locate exposed instances, but its page links only to NVD, not to a template or exploit repository. We did not find an exact matching template in the reviewed ProjectDiscovery nuclei templates directory for 2026, which is a limited observation rather than proof that none exists. No CISA KEV entry was identified in the catalog material reviewed, though that catalog is dated 6 November 2026, one day before NVD publication. CISA notes that KEV inclusion requires reliable evidence of exploitation in the wild, and that a public proof of concept does not by itself demonstrate exploitation. Exploitation should be treated as unconfirmed, not ruled out.
Patch information
IBM fixed CVE-2026-17360 in IBM API Connect v12.1.1.3. Because API Connect is closed source, no public commit or diff exists. The details below come from IBM's security bulletin, the CVE record IBM published to cvelistV5, and the v12.1.1.3 release notes.
What IBM shipped
- Fixed version: IBM's bulletin (node 7295635, published 5 November 2026) covers a large batch of API Connect CVEs, including this one (CWE-798, CVSS 9.8). Its summary says these issues "were addressed in IBM API Connect version v12.1.1.3", and under Remediation/Fixes IBM recommends upgrading to v12.1.1.3 and links the release page.
- Official CVE record: The CVE JSON IBM pushed to the CVE List (cvelistV5 commit
328ae5f) carries the same fix. Itssolutionsfield says to upgrade to v12.1.1.3 and points to Fix Central via IBM support node 7290205. The bulletin reference is taggedvendor-advisoryandpatch. Many sibling CVEs in the same batch also list a 10.0.8.13 fix for the v10 line, but this record names only the 12.1.0.0 through 12.1.1.2 range, which suggests the hardcoded credential exists only in the v12 code base. - Release artifacts: The v12.1.1.3 release notes describe the update as delivering "important security updates for API Connect customers." Installation and upgrade packages are dated 3 October 2026 and available from Fix Central with an entitlement.
The listed upgrade artifacts include:
upgrade_management_12.1.1.3.tgz upgrade_portal_12.1.1.3.tgz upgrade_analytics_12.1.1.3.tgz upgrade_devportal_12.1.1.3.tgz upgrade_federatedapimanagement_12.1.1.3.tgz upgrade_wmapigateway_12.1.1.3.tgz apiconnect-image-tool_12.1.1.3.tar.gz 12.1.1.3_signatures.zip
The release also includes operator release files, and the signature bundle is provided for verifying the downloads.
What the fix likely means
IBM has not said which subsystem held the credential or what the code change was. For CWE-798, the fix almost always removes a built-in, static credential shared by every install, replacing it with a secret generated per deployment or supplied by the operator, or removing the account or code path entirely. Given the AV:N/AC:L/PR:N/UI:N vector, the practical effect is that the credential stops working as a universal key against patched instances.
Practical points
- Upgrade every subsystem. IBM does not name the affected component, and 12.1.1.3 ships separate upgrade files for management, portal, analytics, gateway and federated management. Moving the whole deployment to 12.1.1.3 is the only way to be sure the vulnerable code is gone.
- Patch the sibling flaws at the same time. The same bulletin and release fix CVE-2026-17403, another "full administrative control" hardcoded credentials issue (CWE-798, CVSS 9.0), and two hardcoded cryptographic key issues, CVE-2026-17310 and CVE-2026-17356 (CWE-321). One upgrade to 12.1.1.3 covers all of them.
- No workaround exists. Under "Workarounds and Mitigations," IBM states "None." The bulletin documents no credential rotation procedure, configuration switch or network rule as an alternative.
Upgrade paths
IBM's 12.1.1.3 release documentation lists these supported starting versions:
- API Connect 12.1.1: 12.1.1.0, 12.1.1.1, 12.1.1.2
- API Connect 12.1.0: 12.1.0.3
- API Connect 10: 10.0.11; 10.0.8.8 through 10.0.8.12 (listed as upgrade sources only, not as affected by this CVE)
The list does not establish a direct path from 12.1.0.0, 12.1.0.1 or 12.1.0.2, all of which fall inside the affected range. If you run one of those, obtain the applicable path from IBM rather than assuming the affected range and the direct upgrade range are the same. Also note that the live Kubernetes, OpenShift and VMware upgrade planning pages describe upgrades to 12.1.1.4, while the bulletin names 12.1.1.3. Check prerequisites against your actual target release.
Affected systems and versions
- Product: IBM API Connect V12 OnPrem
- Vulnerable releases: 12.1.0.0 through 12.1.1.2
- Fixed release: 12.1.1.3
- Configuration: No specific configuration prerequisite is documented. IBM's vector requires only network access with no privileges or user interaction.
- Other deployment models and the v10 line: The reviewed bulletin does not establish affected status for other IBM deployment models, and the CVE record names only the v12 range.
Key dates: IBM's bulletin was first published on 5 November 2026, and NVD published the record at 2026-11-07T05:18:48.197. NVD lists the vendor as Unknown, but the CNA and vendor is IBM (source identifier [email protected]).
Vendor security history
This is not the first critical authentication issue in API Connect. IBM's bulletin for CVE-2025-13915 describes a potential authentication bypass revealed by internal testing, scored CVSS 9.8, allowing remote unauthorized access to the application. The Cyber Security Agency of Singapore identified affected releases as 10.0.8.0 through 10.0.8.5 and 10.0.11.0 and confirmed IBM released security updates. That advisory also suggested that administrators unable to patch immediately could consider disabling Developer Portal self-service signup. That guidance applies only to CVE-2025-13915. The CVE-2026-17360 bulletin lists no workaround.
IBM operates a centralized Product Security Incident Response Team with a risk-based process influenced by the FIRST framework (Discovery, Triage, Remediation, Disclosure), and publicly confirms issues after analysis and issuance of fixes or mitigations. Vulnerabilities can be reported through IBM Support or [email protected], and IBM's My Notifications service distributes critical software updates and security information. The prior case shows a serious authentication defect followed by a documented update response. It does not by itself indicate a breach history or an exploitation rate.
References
- NVD: CVE-2026-17360
- CVE Record: CVE-2026-17360
- IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (node 7295635)
- IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (alternate URL)
- cvelistV5 commit 328ae5f
- IBM API Connect v12.1.1.3 is now available (Fix Central)
- What's new in IBM API Connect 12.1.1.3
- CVE Services API record
- NVD API record
- CWE-798: Use of Hardcoded Credentials
- FIRST CVSS v3.1 Specification Document
- IBM API Connect product page
- IBM API Connect API Manager
- IBM named a Leader in the 2026 Gartner Magic Quadrant for API Management
- IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
- Cyber Security Agency of Singapore: Critical Vulnerability in IBM API Connect
- IBM security vulnerability management (PSIRT)
- OffSeq Threat Radar: CVE-2026-17360
- CISA Known Exploited Vulnerabilities catalog (JSON)
- CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities
- ProjectDiscovery nuclei templates, 2026 CVE directory
- Planning your API Connect upgrade on Kubernetes
- Planning your API Connect upgrade on OpenShift
- Planning your API Connect upgrade on VMware
