CVE-2026-17316 — Ibm Api Connect
HIGHCVE-2026-17316 is a high-severity (CVSS 7.2) Server-Side Request Forgery (SSRF) vulnerability in ibm api connect. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
Description
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
Affected Products
api connectibmDetection & mitigation playbook
Vendor / applianceDetect
Inventory every ibm api connect deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-17316. Check the ibm api connect advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-17316 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.