IBM discloses 208 API Connect flaws, including 47 critical

IBM has disclosed 208 security flaws in its API Connect platform, with CVE records published on 7 November 2026. Of these, 47 are rated critical and 94 high, with several allowing remote code execution or authentication bypass without login. Affected product ranges include API Connect 10.0.8[.]0–10.0.8[.]12 and 12.1.0[.]0–12.1.1[.]2, as well as IBM Aspera Faspex 5.0.0–5.0.19. Most of the API Connect vulnerabilities affect both release lines, though 73 impact only the 12.1 branch.

The highest listed severities reach CVSSv3 9.9, and the most severe example is CVE-2026-17402 (9.9). Notably, several flaws are unauthenticated, enabling login bypass, admin takeover or code execution through issues such as hard-coded credentials, improper cryptographic signature verification and OS command injection.

The article details both unauthenticated and authenticated attack paths. Unauthenticated issues include CVE-2026-17301 (CVSS 9.8) enabling authentication bypass through improper verification of a cryptographic signature, CVE-2026-17360 (9.8) granting full administrative control via hard-coded credentials, and CVE-2026-17408 and CVE-2026-17340 (9.8) allowing code execution via OS command injection and path traversal, respectively.

Authenticated flaws such as CVE-2026-17402 (9.9) enable OS command injection, CVE-2026-17392 (9.9) uses LDAP injection to gain admin access to other tenants, and CVE-2026-17410 (9.9) allows access and modification of other tenants’ portal data. The report notes no public exploit code confirmed in the wild for at least some flaws.

IBM’s guidance calls for applying the latest security updates and restricting management and gateway interfaces to trusted networks, alongside actions like limiting outbound traffic and reviewing tenant and admin accounts.