{"id":"CVE-2026-17280","published":"2026-11-07T05:18:33.853","lastModified":"2026-11-11T05:19:39.920","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.","cvssScore":8.9,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-307"],"vendors":["ibm"],"products":["api connect"],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":["Vendor Advisory"]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 lack proper rate limiting on authentication endpoints, allowing unauthenticated attackers to repeatedly submit credential guesses without account lockout or delay mechanisms. This enables brute-force attacks to eventually discover valid credentials, violating the principle of excessive authentication attempt prevention.","exploitability":"Exploitation requires network access to the authentication endpoint and is hindered by high attack complexity (AC:H), meaning the attacker likely needs to overcome timing, obfuscation, or other non-trivial barriers before brute-forcing succeeds.","blast_radius":"Successful exploitation could lead to full compromise of administrative or user accounts, enabling unauthorized access to APIs, data exfiltration, and potential lateral movement within connected systems.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or 12.1.1.3, where the vendor has addressed the excessive authentication attempt vulnerability (CWE-307).","detection":"Defenders should monitor authentication logs for repeated failed login attempts from the same source IP to credential validation endpoints (e.g., /api/login, /oauth/token), especially with high-frequency bursts and no subsequent success rate decline—this pattern may indicate brute-force activity before account lockout or throttling is enforced.","tags":["brute-force","auth-bypass","rate-limiting","credential-theft","web-api"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:48:26.697Z"}}