IBM API Connect XXE Information Disclosure (CVE-2026-16884)

IBM API Connect manages API gateways, developer portals and the definitions that describe each API. XML external entity injection happens when an application parses XML input and follows an external reference inside it instead of rejecting it.

IBM's record says CVE-2026-16884 lets a remote attacker obtain sensitive information through this path. The record gives no further detail beyond the one-line description, the CWE class and the CVSS vector; it does not name the specific endpoint or file that is parsed.

What an Attacker Gains

The CVSS vector lists no privileges required and no user interaction, with a high confidentiality impact and a low integrity and availability impact. Per that vector, a remote attacker needs no account and no action from a victim to read information the server was not meant to expose.

We leave out which field or import path carries the XML on purpose. Our CVSS entry explains how to read a vector like this one.

How CVE-2026-16884 Scores

IBM, the CNA, scores it CVSS 3.1 9.9 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L. NVD lists IBM's score as the primary source. There is no CVSS 4.0 score in the record or NVD, which lists the entry as Awaiting Analysis.

Published Inside a Large Bulletin

IBM lists CVE-2026-16884 inside a single Security Bulletin titled "Multiple Vulnerabilities in IBM API Connect," alongside 202 other CVE IDs fixed in the same v12.1.1.3 release. A related missing-authorization flaw in the same bulletin, CVE-2026-17362, lets a remote attacker create, modify or delete tenants.

IBM's bulletin is dated 5 November 2026, two days before the CVE program published the CVE-2026-16884 record. NVD published its own entry on 7 November 2026.

What IBM and CISA KEV Say About Exploitation

IBM's bulletin and the CVE record do not state whether CVE-2026-16884 has been exploited. It is not in the CISA Known Exploited Vulnerabilities catalog, version 2026.11.06. IBM credits no external researcher for this entry in the bulletin.

The CVE record and NVD both list IBM API Connect, versions 12.1.0.0 through 12.1.1.2, as affected. IBM's bulletin gives the same range, covering its entire 203-CVE release rather than CVE-2026-16884 alone.

IBM's remediation step is to upgrade to v12.1.1.3, available through Fix Central. IBM's bulletin lists no workaround for CVE-2026-16884 specifically, and names no interim mitigation for the XXE path.

We recommend upgrading promptly given the CVSS 3.1 score of 9.9 and the lack of a workaround. Our vulnerability management guide covers how to prioritize a patch like this one.