Log in Request a demo

Vulnerability

IBM API Connect Missing Authorization Tenant Takeover (CVE-2026-17362)

A missing-authorization flaw in IBM API Connect V12 On-Prem.

CVE ID
CVE-2026-17362
CVSS
9.8 Critical (CVSS 3.1, IBM as CNA and NVD primary source); vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no CVSS 4.0 score in the record or NVD
Affected product
IBM API Connect V12 On-Prem, 12.1.0.0 through 12.1.1.2
Exploited
Unknown
Published
7 November 2026 (CVE record and NVD); IBM Security Bulletin published 5 November 2026

In short

CVE-2026-17362 is a missing-authorization flaw in IBM API Connect V12 On-Prem. IBM's record says it lets a remote attacker create, modify or delete tenants, with no privileges and no user interaction required. IBM, the CNA, scores it CVSS 3.1 9.8 Critical; there is no CVSS 4.0 score in the record or NVD. IBM published the fix, version 12.1.1.3, inside a bulletin covering 203 CVE IDs.

Profile MapVulnerability
  1. CVECVE-2026-17362
  2. ProductIBM IBM API Connect V12 On-Prem, 12.1.0.0 through 12.1.1.2
  3. Fix Steps5actions listedUpgrade to v12.1.1.3

What it allows

IBM API Connect manages API gateways and developer portals, including separate tenants for different API programs. The CVE record says a remote attacker can create, modify or delete tenants because the product is missing an authorization check.

IBM classifies the flaw as CWE-862, Missing Authorization. The record gives no further technical detail beyond that one-line description, the CWE class and the severity rating; it does not name the specific endpoint that is missing the check.

How CVE-2026-17362 Scores

IBM, the CNA, scores it CVSS 3.1 9.8 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no CVSS 4.0 score in the record or NVD.

Published Inside a Large Bulletin

IBM lists CVE-2026-17362 inside a single Security Bulletin titled "Multiple Vulnerabilities in IBM API Connect," alongside 202 other CVE IDs fixed in the same v12.1.1.3 release. Several other entries in that bulletin also score 9.8 or 9.9; IBM groups them by component rather than ranking them against each other.

IBM's bulletin itself is dated 5 November 2026, two days before the CVE program published the CVE-2026-17362 record and NVD published its own entry on 7 November 2026. IBM published this fix the same week as another critical authorization flaw, CVE-2026-123218 in IBM Aspera Faspex.

What IBM and CISA KEV Say About Exploitation

IBM's bulletin and the CVE record do not state whether CVE-2026-17362 has been exploited. As of CISA catalog version 2026.11.06, it is not in the Known Exploited Vulnerabilities catalog.

Who is affected

The CVE record and NVD both list IBM API Connect V12 On-Prem, versions 12.1.0.0 through 12.1.1.2, as affected. IBM's bulletin gives the same range, covering its whole 203-CVE release, not CVE-2026-17362 alone.

IBM's remediation step is to upgrade to v12.1.1.3, available through Fix Central. IBM's own release notes list the v12.1.1.3 installation files as published 3 October 2026, about a month before the 5 November 2026 security bulletin that documents the fixes they carry. IBM lists no workaround for CVE-2026-17362 specifically.

IBM credits no external researcher in the bulletin. Missing-authorization flaws are not unique to API gateways: a similar broken-access-control flaw hit WSO2's REST API, and a tenant-isolation flaw surfaced in Beta9's sandbox the same week.

Timeline

  1. 3 Oct 2026

    IBM's release notes list the v12.1.1.3 installation files as published, ahead of the security bulletin documenting the fixes they carry.

  2. 5 Nov 2026

    IBM publishes its Security Bulletin for the v12.1.1.3 release, covering CVE-2026-17362 and 202 other CVE IDs.

  3. 7 Nov 2026

    The CVE program publishes the CVE-2026-17362 record; NVD publishes its own entry the same day, status Awaiting Analysis.

What to do

  1. Inventory API Connect V12 On-Prem Deployments

    List every API Connect V12 On-Prem instance and record its version. The record covers 12.1.0.0 through 12.1.1.2; any instance in that range needs the fix.

  2. Upgrade to v12.1.1.3

    Move each instance to v12.1.1.3 through Fix Central, as IBM's bulletin instructs. IBM's own release notes show the installation files were available from 3 October 2026.

  3. Review Tenant Changes Before and After the Upgrade

    We recommend auditing tenant creation, modification and deletion events logged before the upgrade. IBM's record does not describe detection steps, so this check is ours.

  4. Check the Rest of the Same Bulletin

    IBM's bulletin fixes 203 CVE IDs in one release, several scored 9.8 or 9.9. We recommend reviewing the full bulletin, not only CVE-2026-17362, before treating an instance as fully patched.

  5. Limit Who Can Reach Tenant-Management Endpoints

    IBM lists no workaround for CVE-2026-17362. Until an instance is upgraded, we recommend restricting network access to API Connect's tenant-management functions.

Questions

What does CVE-2026-17362 let an attacker do in IBM API Connect?

IBM's record says a remote attacker can create, modify or delete tenants because the product is missing an authorization check, with no privileges or user interaction required.

Which API Connect versions does CVE-2026-17362 affect?

The CVE record and NVD list IBM API Connect V12 On-Prem, versions 12.1.0.0 through 12.1.1.2. IBM names v12.1.1.3 as the fixed release.

Is CVE-2026-17362 the only critical flaw in this IBM bulletin?

IBM's bulletin lists 203 CVE IDs fixed in the same release, and several entries besides CVE-2026-17362 also score 9.8 or 9.9.

Is there a workaround before upgrading?

IBM's bulletin lists "Workarounds and Mitigations: None" for this release, and names the version upgrade as the fix.

Is CVE-2026-17362 in the CISA KEV catalog?

It is not in catalog version 2026.11.06. IBM's bulletin and the CVE record do not state whether the flaw has been exploited.

In our research

  1. Three Ways Beta9 Lets a Tenant Escape Its Sandbox November 2026

Sources

  1. CVE-2026-17362 Record CVE Program / IBM
  2. CVE-2026-17362 NVD
  3. Security Bulletin: Multiple Vulnerabilities in IBM API Connect IBM
  4. IBM API Connect v12.1.1.3 is now available IBM
  5. Known Exploited Vulnerabilities Catalog CISA

Last updated 7 November 2026

Browse the threat library

Keep exploring

Knowledge Hub