{"id":"CVE-2026-17146","published":"2026-11-07T05:18:27.843","lastModified":"2026-11-11T05:19:38.937","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a cross-site scripting (XSS) vulnerability due to insufficient input validation, allowing an authenticated attacker to inject malicious JavaScript that executes in the context of other users' sessions and enables theft of sensitive data.","exploitability":"Exploitation requires low skill and a valid authenticated session, but no public exploit code is available.","blast_radius":"Successful exploitation could lead to session hijacking, unauthorized data access, or manipulation of API management functions within the IBM API Connect portal.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3 or later, as these versions contain the fix for CVE-2026-17146.","detection":"Defenders should monitor for anomalous JavaScript execution in browser sessions accessing the API Connect admin portal, such as unexpected DOM modifications or outbound requests to external domains from legitimate user sessions; however, no specific log entries or network artifacts are reliably attributable to this vulnerability per the published description.","tags":["xss","web","auth-bypass","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:45:14.161Z"}}