{"id":"CVE-2026-16709","published":"2026-11-07T05:18:19.730","lastModified":"2026-11-10T17:00:34.657","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a stored cross-site scripting (XSS) vulnerability where untrusted user input is not properly sanitized before being rendered in web pages, allowing an authenticated attacker to inject malicious JavaScript that executes in other users' browsers. This enables session hijacking, credential theft, or unauthorized actions on behalf of victims.","exploitability":"Exploitation requires a low-privilege authenticated user with access to the vulnerable input field and social engineering (e.g.,诱使 another user view the malicious page), as indicated by CVSS UI:R and PR:L.","blast_radius":"If exploited, attackers could compromise any user who views the injected payload, including administrators, leading to full account takeover, data exfiltration, or manipulation of API management configurations.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for this XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","auth-bypass","session-hijack"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:55:05.131Z"}}