{"id":"CVE-2026-17353","published":"2026-11-07T05:18:46.880","lastModified":"2026-11-11T05:19:41.880","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to trick the server into making unintended requests to internal or external systems, potentially exposing sensitive data and bypassing security controls.","exploitability":"Exploitation requires valid authentication and network access to the affected API Connect instance; no public exploit is available, but the low attack complexity makes it feasible for skilled attackers.","blast_radius":"Successful exploitation could lead to unauthorized access to internal services, credential leakage, or further compromise of backend systems via the compromised server’s network privileges.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the vendor-provided fix for this SSRF issue.","detection":"Defenders should monitor for anomalous outbound HTTP/HTTPS requests from the API Connect gateway or management components to unexpected internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 169.254.x.x) or non-standard ports in access logs or proxy logs; however, no specific log field or signature is guaranteed to indicate exploitation.","tags":["ssrf","auth-bypass","info-leak","web","api"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:59:14.861Z"}}