# IBM API Connect vulnerabilities Source: https://junglewise.ai/threats/technologies/api-connect Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/api-connect.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 207 vulnerabilities in IBM API Connect: 205 in the last 7 days and 205 in the last 90 days, 48 of them critical and 0 exploited in the wild. The most recent, CVE-2026-75590, was published on 7 November 2026. 205 vulnerabilities in the last four weeks, up from none in the four before. 47 critical against 0. ## Counts - Last 7 days: 205 - Last 30 days: 205 - Last 90 days: 205 - All time: 207 (48 critical, 0 exploited in the wild) ## About IBM API Connect An integrated API management solution for creating, managing, and securing APIs. ## Latest IBM API Connect vulnerabilities - [CVE-2026-75590: IBM API Connect server-side request forgery](https://junglewise.ai/threats/cve-2026-75590-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-a-remote) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-19131: IBM API Connect missing authorization in index access](https://junglewise.ai/threats/cve-2026-19131-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-low) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-19129: IBM API Connect improper backup server certificate verification](https://junglewise.ai/threats/cve-2026-19129-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (medium, CVSS 6.8, published 7 Nov 2026) - [CVE-2026-19128: IBM API Connect server-side request forgery via unauthorized request](https://junglewise.ai/threats/cve-2026-19128-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-an) (high, CVSS 7.5, published 7 Nov 2026) - [CVE-2026-19126: IBM API Connect weak cryptographic algorithms in authentication](https://junglewise.ai/threats/cve-2026-19126-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (medium, CVSS 5.9, published 7 Nov 2026) - [CVE-2026-19124: IBM API Connect hard-coded cryptographic key in credential storage](https://junglewise.ai/threats/cve-2026-19124-ibm-api-connect-10-0-8-0-through-10-0-8-12-could-allow-an) (medium, CVSS 6.8, published 7 Nov 2026) - [CVE-2026-19121: IBM API Connect improper authorization in tenant context](https://junglewise.ai/threats/cve-2026-19121-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-an) (high, CVSS 8.3, published 7 Nov 2026) - [CVE-2026-18838: IBM API Connect improper authentication and authorization bypass](https://junglewise.ai/threats/cve-2026-18838-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-a-remote) (critical, CVSS 9.4, published 7 Nov 2026) - [CVE-2026-18836: IBM API Connect server-side request forgery](https://junglewise.ai/threats/cve-2026-18836-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.3, published 7 Nov 2026) - [CVE-2026-18689: IBM API Connect authorization bypass in token validation](https://junglewise.ai/threats/cve-2026-18689-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-18535: IBM API Connect regular expression denial of service](https://junglewise.ai/threats/cve-2026-18535-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.6, published 7 Nov 2026) - [CVE-2026-17428: IBM API Connect authorization bypass in request URL parameters](https://junglewise.ai/threats/cve-2026-17428-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (medium, CVSS 5, published 7 Nov 2026) - [CVE-2026-17411: IBM API Connect SQL injection in database queries](https://junglewise.ai/threats/cve-2026-17411-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 7.6, published 7 Nov 2026) - [CVE-2026-17410: IBM API Connect argument delimiter neutralization in multi-tenant](https://junglewise.ai/threats/cve-2026-17410-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17409: IBM API Connect access control bypass via case sensitivity](https://junglewise.ai/threats/cve-2026-17409-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.4, published 7 Nov 2026) - [CVE-2026-17408: IBM API Connect arbitrary code execution in OS command](https://junglewise.ai/threats/cve-2026-17408-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.8, published 7 Nov 2026) - [CVE-2026-17407: IBM API Connect SQL injection in sign-in](https://junglewise.ai/threats/cve-2026-17407-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 8.5, published 7 Nov 2026) - [CVE-2026-17406: IBM API Connect server-side request forgery address check bypass](https://junglewise.ai/threats/cve-2026-17406-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 8.5, published 7 Nov 2026) - [CVE-2026-17405: IBM API Connect broken object-level authorization in keystore](https://junglewise.ai/threats/cve-2026-17405-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 8.8, published 7 Nov 2026) - [CVE-2026-17404: IBM API Connect server-side request forgery in authenticated endpoints](https://junglewise.ai/threats/cve-2026-17404-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 8.5, published 7 Nov 2026) - [CVE-2026-17403: IBM API Connect hard-coded credentials allow admin access](https://junglewise.ai/threats/cve-2026-17403-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9, published 7 Nov 2026) - [CVE-2026-17402: IBM API Connect OS command injection](https://junglewise.ai/threats/cve-2026-17402-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17401: IBM API Connect stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-17401-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-17400: IBM API Connect SQL injection in authenticated context](https://junglewise.ai/threats/cve-2026-17400-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (high, CVSS 7.7, published 7 Nov 2026) - [CVE-2026-17399: IBM API Connect arbitrary code execution via insufficient upload validation](https://junglewise.ai/threats/cve-2026-17399-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) ## Most severe IBM API Connect vulnerabilities - [CVE-2026-17410: IBM API Connect argument delimiter neutralization in multi-tenant](https://junglewise.ai/threats/cve-2026-17410-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17402: IBM API Connect OS command injection](https://junglewise.ai/threats/cve-2026-17402-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17399: IBM API Connect arbitrary code execution via insufficient upload validation](https://junglewise.ai/threats/cve-2026-17399-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17392: IBM API Connect LDAP injection in directory queries](https://junglewise.ai/threats/cve-2026-17392-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17359: IBM API Connect arbitrary code execution via improper code generation](https://junglewise.ai/threats/cve-2026-17359-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17354: IBM API Connect path traversal arbitrary file writes](https://junglewise.ai/threats/cve-2026-17354-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-a-remote) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17342: IBM API Connect code injection in template processing](https://junglewise.ai/threats/cve-2026-17342-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17336: IBM API Connect SQL injection](https://junglewise.ai/threats/cve-2026-17336-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-a-remote) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17298: IBM API Connect server-side request forgery](https://junglewise.ai/threats/cve-2026-17298-ibm-api-connect-10-0-8-0-through-10-0-8-12-and-12-1-0-0-through) (critical, CVSS 9.9, published 7 Nov 2026) - [CVE-2026-17239: IBM API Connect path traversal remote code execution](https://junglewise.ai/threats/cve-2026-17239-ibm-api-connect-12-1-0-0-through-12-1-1-2-could-allow-a-remote) (critical, CVSS 9.9, published 7 Nov 2026) ## Vulnerabilities per week 205 vulnerabilities in the last four weeks, up from none in the four before. 47 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 205 | 47 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM Langflow](https://junglewise.ai/threats/technologies/langflow-oss): 154 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM API Connect vulnerabilities", https://junglewise.ai/threats/technologies/api-connect, 9 November 2026.