{"id":"CVE-2026-17409","published":"2026-11-07T05:18:58.157","lastModified":"2026-11-10T05:18:04.357","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.","cvssScore":9.4,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwes":["CWE-178"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a case-sensitivity flaw (CWE-178) that allows unauthenticated attackers to bypass access controls by sending requests with altered casing, enabling unauthorized administrative operations and potential exposure of sensitive data.","exploitability":"Exploitation is straightforward for remote attackers due to the lack of authentication or user interaction required; only knowledge of the affected endpoints and ability to craft case-altered HTTP requests is needed.","blast_radius":"Successful exploitation could allow full compromise of administrative functions and leakage of sensitive configuration or operational data across all tenants sharing the API Connect instance.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","case-sensitivity","admin-panel","sensitive-data-exposure"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:00:08.870Z"}}