{"id":"CVE-2026-16884","published":"2026-11-07T05:18:22.440","lastModified":"2026-11-11T05:19:38.523","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","cwes":["CWE-611"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains an XML external entity (XXE) vulnerability in versions 12.1.0.0 through 12.1.1.2, allowing unauthenticated remote attackers to read sensitive server-side files or cause denial of service by injecting malicious XML content.","exploitability":"Exploitation is straightforward for remote attackers with network access to the affected API Connect endpoints that parse XML input without disabling external entity resolution.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality via file disclosure, partial integrity loss through potential SSRF or command injection if the XML parser interacts with other subsystems, and availability impact via XML bomb attacks.","remediation":"Upgrade IBM API Connect to version 12.1.1.3 or later, which contains the vendor's official fix for CVE-2026-16884.","detection":"Defenders should monitor for unusually large or complex XML payloads in HTTP requests to API Connect endpoints, especially those containing DOCTYPE declarations with external entity references (e.g., <!ENTITY ... SYSTEM","tags":[],"model":"garnet-coder","analyzedAt":"2026-11-07T09:43:57.635Z"}}