{"id":"CVE-2026-17190","published":"2026-11-07T05:18:29.840","lastModified":"2026-11-11T05:19:39.190","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a stored cross-site scripting (XSS) vulnerability where unsanitized HTML content provided by an authenticated provider is rendered in the web interface, allowing execution of arbitrary JavaScript in victims' browsers. This enables session hijacking, credential theft, or malicious actions performed on behalf of the user.","exploitability":"Exploitation requires a low-privilege authenticated attacker (PR:L) to supply malicious HTML/JS via provider-controlled content and trick a victim user into viewing it (UI:R), making it moderately difficult due to the need for social engineering and valid credentials.","blast_radius":"If exploited, an attacker could steal session tokens, impersonate users, modify UI to deceive users, or redirect to malicious sites, potentially compromising administrative functions if high-privilege users are targeted.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3, which contain the vendor-provided fix for this XSS vulnerability.","detection":"Defenders should monitor web application logs for requests containing unsanitized HTML/JS payloads (e.g., <script>, onerror=, javascript:) in provider-submitted fields such as description, name, or metadata fields; anomalies in user-agent behavior or unexpected outbound requests from the browser context may also indicate successful exploitation.","tags":["xss","web","auth-bypass","session-hijack","ibm"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:55:13.512Z"}}