IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi)

IBM published a security bulletin on Nov 5 2026 covering multiple vulnerabilities in IBM API Connect V12 OnPrem (v12.1.0.0 through v12.1.1.2), fixed by upgrading to v12.1.1.3. The bulletin lists 202 CVEs scored by IBM; 46 are critical (CVSS ≥ 9.0). Highlights include unauthenticated missing-authorization tenant create/modify/delete (CVE-2026-17362, CVSS 9.8), authentication bypass via improper cryptographic-signature verification (CVE-2026-17301, 9.8), hard-coded credentials giving full admin control (CVE-2026-17360, 9.8), unauthenticated path-traversal RCE (CVE-2026-17340, 9.8), OS command injection (CVE-2026-17408, 9.8), XXE (CVE-2026-16884, 9.9), and authenticated SQL injection / code-generation RCEs rated 9.9. IBM says there are no workarounds — upgrade to v12.1.1.3 via Fix Central. NVD detail pages for several of these IDs were not populated at first publication.

Why this severity: IBM rates 46 of 202 CVEs critical (CVSS ≥ 9.0), including unauthenticated tenant takeover (CVE-2026-17362, 9.8), auth bypass, hard-coded credentials, RCE, XXE and SQLi; no workarounds

Started

Nov 5, 2026

CVEs

CVE-2026-17362CVE-2026-17301CVE-2026-17313CVE-2026-17360CVE-2026-17340CVE-2026-17408CVE-2026-16720CVE-2026-17278CVE-2026-16884CVE-2026-17336CVE-2026-17117CVE-2026-17150CVE-2026-17402CVE-2026-16920CVE-2026-17049

• IBM
• RCE
• Auth bypass
• SQL injection
• #Security Bulletin
• #Unauthenticated
• #Hardcoded credentials
• #Command injection