Introduction
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 ship with hard-coded credentials. IBM says a remote attacker could use them to gain full administrative control of the platform. IBM rates the confidentiality, integrity, and availability impacts as High, publishes no workaround, and offers upgrading as the only fix it supports.
IBM API Connect is an integrated API management offering covering the API lifecycle: creation, security, management, socialization, and analysis. IBM describes it as combining development assistance, lifecycle management, and runtime governance across hybrid environments. In an announcement published 1 October 2026, IBM stated it was named a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th consecutive time. That is a positioning claim rather than a market share figure, but it places the product among the established platforms enterprises use to govern API traffic.
Technical information
Root cause
IBM classifies CVE-2026-17403 as CWE-798: Use of Hard coded Credentials. The CVE record states that affected versions "could allow a remote attacker to gain full administrative control due to the use of hard coded credentials."
MITRE defines CWE-798 as a product containing embedded credentials, such as a password or cryptographic key. The weakness has two common variations:
- Inbound: the product checks credentials supplied by a user against an embedded set.
- Outbound: the product uses embedded credentials to authenticate to another system or component.
IBM's disclosure does not say which variation applies. The bulletins also leave out several details:
- the credential value
- whether it is a password, token, or key
- which subsystem or component holds it
- which endpoint or service accepts it
- how the code was changed in the fix
API Connect is closed source, so there is no public commit, diff, or code snippet to examine. The supported technical explanation therefore stops at two facts. An embedded credential exists, and using it can lead to administrative control. Nothing in the sources establishes a specific login endpoint, service account, request format, or credential extraction technique. Nothing establishes operating system command execution as the exploitation method either.
CVSS assessment
IBM published the following CVSS 3.1 vector, scoring 9.0 (Critical):
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Under the FIRST CVSS v3.1 specification, the metrics mean the following:
- Attack Vector: Network. The attack is delivered over the network, which FIRST notes includes attacks from within an intranet. It does not mean a given installation is internet exposed.
- Attack Complexity: High. Success depends on conditions beyond the attacker's control. IBM does not describe those conditions.
- Privileges Required: None. The attacker needs no existing account or privileges.
- User Interaction: None. No other user has to take any action.
- Scope: Changed. The impact crosses the security boundary of the vulnerable component. IBM does not name the boundary involved.
- Confidentiality, Integrity, Availability: High.
NVD lists the record as "Awaiting Analysis" and has not published an independent NIST score. The 9.0 is IBM's assessment as the CNA.
Attack flow supported by the disclosures
The public record only supports a high-level sequence. This outline is drawn from IBM's description and vector, not from a demonstrated exploit:
- The attacker has network reach to the affected API Connect component, from the internet or from inside the network.
- The attacker holds no prior privileges, and no user interaction is needed.
- The attacker meets whatever undisclosed conditions make the attack complexity High.
- The embedded credential is used against the product. IBM does not say whether this means presenting it to an inbound check or abusing it on an outbound connection.
- The attacker gains full administrative control, with impact extending beyond the vulnerable component (Changed scope).
Because of the High complexity rating, this should not be described as a simple credential replay. The steps between gaining reach and gaining administrative control are not public.
Not the same as CVE-2026-17360
The V12 bulletin also covers CVE-2026-17360. It is another hard-coded credentials flaw with the same stated outcome, full administrative control, but its vector is different:
- CVE-2026-17403: CVSS 9.0, Attack Complexity High, Scope Changed, affects both the 10.0.8 and V12 branches.
- CVE-2026-17360: CVSS 9.8, Attack Complexity Low, Scope Unchanged, listed only in the 12.1.1.3 bulletin.
The matching description is not enough to assume the two share exploitation conditions. Track each identifier against its own vector.
Exploitation status
No reviewed source confirms active exploitation. OffSeq Threat Radar reports:
- no evidence on record of weaponization or exploitation in the wild
- no public exploit code indexed in Metasploit or Exploit Database
- no attack traffic recorded by its Mirage sensors
- that the CVE is not in the CISA Known Exploited Vulnerabilities catalog
No threat actor has been named. OffSeq's exploitation indexes are dated 6 November 2026, one day before the CVE was published on 7 November 2026, so they say little about activity after disclosure. Exploitation is unconfirmed, and no attribution is available.
Patch information
IBM fixed CVE-2026-17403 in two maintenance releases, one per affected branch. Two security bulletins dated 5 November 2026 document the fixes, and NVD lists those bulletins as its only references for this CVE.
- API Connect 10.0.8 (LTS): affected 10.0.8.0 through 10.0.8.12. Fixed in 10.0.8.13. See IBM Security Bulletin 7295637.
- API Connect V12 OnPrem: affected 12.1.0.0 through 12.1.1.2. Fixed in 12.1.1.3. See IBM Security Bulletin 7295635.
Both bulletins say IBM "strongly recommends addressing the vulnerability now" by upgrading. Both list "Workarounds and Mitigations: None", so no configuration change is offered to disable the embedded credential in the meantime.
What the fix is and is not
IBM does not say how the credential was removed. Typical CWE-798 fixes take one of three approaches:
- removing the built-in secret
- generating a unique secret per installation at deployment time
- requiring operators to supply their own secret
IBM has not confirmed which approach it used here.
The secret was built into the shipped product, so updating one component is not enough. You need the full fixed release. Each bulletin also covers more than 100 separate CVEs, so the CVE-2026-17403 fix cannot be installed on its own.
Related CVEs in the same releases
These releases also fix several other credential and key flaws. Make sure scanners and tickets reference the correct identifier:
- CVE-2026-17360: a separate hard-coded credentials flaw (CVSS 9.8), listed only in the 12.1.1.3 bulletin.
- CVE-2026-19124: a hard-coded cryptographic key that protects stored credentials, listed in the 10.0.8.13 bulletin.
- CVE-2026-17356 and CVE-2026-17310: hard-coded cryptographic key issues (CWE-321), listed in the 12.1.1.3 bulletin.
Getting the fixed build
12.1.1.3: The bulletin links to IBM's "API Connect v12.1.1.3 is now available" release page (node 7290205), which says the release "delivers important security updates." Downloads were published 3 October 2026 and include:
- container images, including the API Connect image tool archive, and operator release files
- VMware OVAs and upgrade files for each subsystem: management, developer portal, analytics, federated API management, and webMethods API Gateway
- the apicup and apicupgrade tooling
- a signature bundle (12.1.1.3_signatures.zip) for verifying the downloads
The page also notes that OVA upgrades may need optional Kubernetes control plane files.
10.0.8.13: The bulletin links directly to IBM Fix Central for the IBM API Connect product family.
All packages are distributed through Fix Central and require a valid IBM entitlement. After upgrading, confirm that every subsystem reports 10.0.8.13 or 12.1.1.3. In a partly upgraded deployment, some components can still be running vulnerable builds.
Affected systems and versions
- IBM API Connect 10.0.8: versions 10.0.8.0 through 10.0.8.12, inclusive. Fixed in 10.0.8.13.
- IBM API Connect V12 OnPrem: versions 12.1.0.0 through 12.1.1.2, inclusive. Fixed in 12.1.1.3.
IBM does not name a specific vulnerable configuration or subsystem. Treat any deployment running a version in these ranges as affected until every subsystem has been upgraded to the fixed release for its branch.
Vendor security history
This is not the first critical authentication-related finding in API Connect:
- CVE-2026-17360: hard-coded credentials that could permit full administrative control. CVSS 9.8, Low complexity, Unchanged scope. Fixed in the same V12 release.
- CVE-2025-13915: an authentication bypass that could permit unauthorized application access. CVSS 9.8.
For CVE-2025-13915, IBM recommended upgrading. The Cyber Security Agency of Singapore urged affected users to update immediately and suggested disabling Developer Portal self-service signup if patching right away was not feasible. That interim measure applied only to CVE-2025-13915. The current bulletins list no workaround for CVE-2026-17403.
Together, these records show repeated serious authentication weaknesses alongside published vendor fixes. They do not show a shared root cause, a common campaign, or a measured failure rate. IBM runs a centralized PSIRT process with support, researcher, and email reporting channels, and product vulnerability reports go to [email protected]. Gartner recognition and that response process are useful context, but neither reduces the need to apply these fixes.
References
- NVD entry for CVE-2026-17403
- Official CVE record for CVE-2026-17403 (CVE Services API)
- NVD API record for CVE-2026-17403
- IBM Security Bulletin 7295637: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)
- IBM Security Bulletin 7295635: Multiple Vulnerabilities in IBM API Connect (12.1.1.3)
- IBM API Connect v12.1.1.3 is now available
- IBM API Connect v10.0.8.13 is now available
- MITRE CWE-798: Use of Hard coded Credentials
- FIRST CVSS v3.1 Specification Document
- OffSeq Threat Radar entry for CVE-2026-17403
- Halo Security advisory for CVE-2026-17403
- VulDB entry for CVE-2026-17403
- IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
- Cyber Security Agency of Singapore: Critical Vulnerability in IBM API Connect
- IBM named a Leader in the 2026 Gartner Magic Quadrant for API Management
- IBM Documentation: API Connect overview
- IBM security vulnerability management (PSIRT)
- CISA Known Exploited Vulnerabilities feed
