IBM API Connect gets 208 CVE records in a day, 47 critical and 54 needing no login: what IBM says

208 records, one product, one morning

On Saturday 7 November 2026 the CVE Program published 208 vulnerability records for IBM API Connect, every one assigned and scored by IBM. IBM's own scores put 47 of them at critical (9.0 or above), 94 at high, 64 at medium and 3 at low. That is 22.6 percent critical and 67.8 percent critical or high (derived). Twenty records score 9.9. Read the vectors rather than the scores and the sharper number appears: 54 of the 208 need no privileges at all (PR:N, 26.0 percent, derived), and 18 of those are critical. This briefing counted every record from NVD's listing of all 208 and from IBM's two bulletins, read between 16:33 and 16:38 UTC on Saturday 7 November 2026.

API Connect is the IBM product organisations use to publish APIs, issue keys and tokens to the developers and applications that call them, and run the gateway that checks those calls. A flaw that hands out a token for someone else, such as CVE-2026-16720 below, is therefore a flaw in the part of the estate that other systems trust to say who a caller is.

Stated, and not stated

Two version lines, two fixes

IBM wrote one bulletin per supported line. The 12.1 bulletin says "Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.3" and lists the affected product as "API Connect V12 OnPrem", versions v12.1.0.0 to v12.1.1.2. The 10.0.8 bulletin says the same of version 10.0.8.13 and lists V10.0.8.0 to V10.0.8.12. Both say "IBM strongly recommends addressing the vulnerability now by upgrading" and both give the workaround as "None". Both carry one line of history: "05 Nov 2026: Initial Publication".

Comparing the two lists (derived): 131 CVEs appear in both bulletins, 72 only in the 12.1 bulletin, and 4 only in the 10.0.8 one. The 208th record, CVE-2026-18535, a 9.6 denial of service flaw, is in neither: its record cites two earlier IBM bulletins of 8 and 14 October 2026. Every one of the 47 critical records applies to 12.1; 26 apply to 10.0.8. One record disagrees with itself: CVE-2026-16679's description names only 12.1, while its affected versions and both bulletins include 10.0.8.

IBM's v12.1.1.3 page says the release "delivers important security updates for API Connect customers" and that the files "can be downloaded with proper entitlement from Fix Central". The 10.0.8 bulletin points to Fix Central as well; that page needs a browser session and was not read here, so the 10.0.8.13 release date is not established. Earlier IBM bulletins on the same pattern are covered in this site's Langflow briefing.

What an attacker needs

CVSS records the precondition in the Privileges Required metric. Sorted that way, the batch splits three ways: no login (PR:N), a low privilege login (PR:L), and a privileged role (PR:H). Two hundred of the 208 vectors are network reachable (AV:N). The grid below is every record.

Zoom

This is where the friendly name does the work of a control. 143 of the 208 descriptions say "a remote authenticated attacker", which reads like an insider. In CVSS terms it is PR:L, a low privilege account, and 142 records need nothing more. In an API product that runs a developer portal, a low privilege account can be the kind of account a developer is meant to obtain. Neither the bulletins nor the records say whether self registration on the portal is enough, so treat "authenticated" as a precondition to check in your own configuration, not as a barrier.

The 18 critical records that need no login, in IBM's own words between "could allow" and "due to":

Where the flaws sit, and how little the records say

IBM's download page for v12.1.1.3 names the parts of a deployment as files: Management, Developer Portal, CMS Portal, Analytics, a webMethods API Gateway, Federated API Management, the toolkit. The records rarely say which part a flaw is in. Searching the 208 descriptions (derived), 9 name a part: one the management service, one gateway configuration, one portal data, two analytics, four a directory or LDAP. The other 199 say only "IBM API Connect".

Zoom

Two themes do show through the wording. Sixteen records name tenants, mostly data or actions belonging to "other tenants": CVE-2026-17362, a 9.8 that needs no login, could allow an attacker "to create, modify, or delete tenants due to missing authorization". Six name tokens, including CVE-2026-16720 and CVE-2026-17370, a 6.4 that could allow an authenticated attacker "to obtain an access token for another user". Three records say an attacker could gain "full administrative control": two through hard coded credentials (CVE-2026-17360 and CVE-2026-17403) and one through a weak random number generator (CVE-2026-17386, 10.0.8 only). Seventeen descriptions say an attacker could execute arbitrary code, commands or SQL (derived).

Server side request forgery alone is 57 records, the largest single weakness: the product can be made to fetch addresses it should not, from webhooks, imported definitions and endpoint URLs, per the wording. Authorisation flaws, chiefly CWE-639 object level checks, add 51. In a product whose job is deciding who may call what, those two families are most of the batch.

The fix came first

IBM's v12.1.1.3 page dates every download file "3 October, 2026". An IBM bulletin of 8 October said vulnerabilities were addressed in v12.1.1.3, and one of 14 October said the same of 10.0.8.13; those two list mostly other projects' CVEs in bundled components, with CVE-2026-18535 the only IBM scored entry this site found in them. The bulletins naming IBM's own 207 followed on 5 November, 33 days after the v12.1.1.3 files, and the records on 7 November, 35 days after (derived). The 13 records sampled on CVE.org were published between 04:31 and 04:56 UTC.

Zoom

The order matters to a defender in two ways. An installation already on v12.1.1.3 has had the fix since early October, whatever its change log said at the time. An installation on the 12.1 line that waited for named CVEs before upgrading carried them for five weeks after the v12.1.1.3 files were dated; for the 10.0.8 line, the date of the 10.0.8.13 files is not established here. Whether anyone used them in that window is not stated.

CVE-2026-16720: a token for someone else

The record IBM published reads: API Connect "could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed." IBM scores it 9.8 with the CVSS 3.1 vector AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H and weakness CWE-287, Improper Authentication. It applies to both lines.

What the record establishes: a network caller with no privileges could end up holding a valid token issued for another user, and the gap is in how sign in against a connected directory is enforced. What it does not establish: which directory types or sign in configurations are affected, whether local user registries are, what the token then grants downstream, or whether the flaw needs a particular setting. Systems that accept API Connect tokens would see such a token as genuine, which is why this one deserves attention beyond its score.

What to do, in order

Technical details

Five entries from IBM's 12.1 bulletin, copied as printed. Each lists the CVE, IBM's description, the CWE, the scoring source, the base score and the vector. A defender uses them to match the bulletin against a scanner's findings and to see which preconditions apply.

CVEID:   CVE-2026-16720
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
CWE:   CWE-287: Improper Authentication
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17313
DESCRIPTION:   IBM API Connect could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.
CWE:   CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17360
DESCRIPTION:   IBM API Connect could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CWE:   CWE-798: Use of Hard-coded Credentials
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17362
DESCRIPTION:   IBM API Connect could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
CWE:   CWE-862: Missing Authorization
CVSS Source:   IBM
CVSS Base score:   9.8
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2026-17409
DESCRIPTION:   IBM API Connect could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
CWE:   CWE-178: Improper Handling of Case Sensitivity
CVSS Source:   IBM
CVSS Base score:   9.4
CVSS Vector:   (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)

The affected versions and remediation as each bulletin prints them. The 10.0.8 text is cut where it continues with a Fix Central link.

Affected Products and Versions
| Affected Product(s) | Version(s)
| API Connect V12 OnPrem | v12.1.0.0 - v12.1.1.2
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3
Fix Central Link: https://www.ibm.com/support/pages/node/7290205
Workarounds and Mitigations
None

Affected Products and Versions
| Affected Product(s) | Version(s)
| API Connect | V10.0.8.0 - V10.0.8.12
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13

The affected versions structure in the CVE-2026-16720 record, as IBM filed it. Asset inventories that match on version ranges can use it directly.

[
 {
  "vendor": "IBM",
  "product": "API Connect",
  "versions": [
   {
    "status": "affected",
    "version": "12.1.0.0",
    "lessThanOrEqual": "12.1.1.2",
    "versionType": "semver"
   },
   {
    "status": "affected",
    "version": "10.0.8.0",
    "lessThanOrEqual": "10.0.8.12",
    "versionType": "semver"
   }
  ],
  "cpes": [
   "cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*",
   "cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*",
   "cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*",
   "cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"
  ]
 }
]

The CPE names in the CVE-2026-16679 record, the record whose description names only 12.1 while its structured data includes 10.0.8. A scanner keyed on these CPE names would match both lines.

cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*

Score and vector for the six highest scoring records that need no login, as NVD carries IBM's scores. These match the bulletin text.

CVE-2026-16884  9.9  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
CVE-2026-16720  9.8  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-17278  9.8  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-17301  9.8  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-17313  9.8  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-17340  9.8  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Neither the bulletins nor the records publish indicators, detection rules or log lines. Nothing here describes how to trigger any flaw.

The question IBM has not answered

IBM shipped the fixed v12.1.1.3 files on 3 October and described 207 of its own flaws in them on 5 November, 33 days later, under a title that says only "Multiple Vulnerabilities" and with no workaround. Customers deciding in October whether to take v12.1.1.3 could find one of IBM's own flaws in IBM's October bulletin, CVE-2026-18535, and not the other 207, 46 of them critical and 18 needing no login. So the question for IBM is this: when one upgrade closes more than 200 flaws, why did the customers who run the token gateway learn what it fixed five weeks after the fix shipped?

Key facts