IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi) · updates https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026 IBM published a security bulletin on Nov 5 2026 covering multiple vulnerabilities in IBM API Connect V12 OnPrem (v12.1.0.0 through v12.1.1.2), fixed by upgrading to v12.1.1.3. The bulletin lists 202 CVEs scored by IBM; 46 are critical (CVSS ≥ 9.0). Highlights include unauthenticated missing-authorization tenant create/modify/delete (CVE-2026-17362, CVSS 9.8), authentication bypass via improper cryptographic-signature verification (CVE-2026-17301, 9.8), hard-coded credentials giving full admin control (CVE-2026-17360, 9.8), unauthenticated path-traversal RCE (CVE-2026-17340, 9.8), OS command injection (CVE-2026-17408, 9.8), XXE (CVE-2026-16884, 9.9), and authenticated SQL injection / code-generation RCEs rated 9.9. IBM says there are no workarounds — upgrade to v12.1.1.3 via Fix Central. NVD detail pages for several of these IDs were not populated at first publication. en Thu, 05 Nov 2026 00:00:00 GMT IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi): IBM publishes Security Bulletin: Multiple Vulnerabilities in IBM API Connect. 202 CVEs addressed in API Connect V12 OnPrem by upgrading to v12.1.1.3; no workarounds. Affected: v12.1.0.0–v12.1.1.2. https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026 https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026#2026-11-05-8496b92a Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39">Source</a></p> IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi): IBM announces API Connect v12.1.1.3 is available on Fix Central (the fixed release for this bulletin). https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026 https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026#2026-11-05-158dbc3d Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://www.ibm.com/support/pages/node/7290205">Source</a></p>