# IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi) · pwn.watch > IBM published a security bulletin on Nov 5 2026 covering multiple vulnerabilities in IBM API Connect V12 OnPrem (v12.1.0.0 through v12.1.1.2), fixed by upgrading to v12.1.1.3. The bulletin lists 202 CVEs scored by IBM; 46 are critical (CVSS ≥ 9.0). Highlights include unauthenticated missing-authorization tenant create/modify/delete (CVE-2026-17362, CVSS 9.8), authentication bypass via improper cryptographic-signature verification (CVE-2026-17301, 9.8), hard-coded credentials giving full admin control (CVE-2026-17360, 9.8), unauthenticated path-traversal RCE (CVE-2026-17340, 9.8), OS command injection (CVE-2026-17408, 9.8), XXE (CVE-2026-16884, 9.9), and authenticated SQL injection / code-generation RCEs rated 9.9. IBM says there are no workarounds — upgrade to v12.1.1.3 via Fix Central. NVD detail pages for several of these IDs were not populated at first publication. Page: https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026 · generated 2026-11-07T15:22:27.765Z ## Status - Severity: critical · status: live · patch: patched - Product: IBM API Connect V12 OnPrem - Started: 2026-11-05 - CVEs: CVE-2026-17362, CVE-2026-17301, CVE-2026-17313, CVE-2026-17360, CVE-2026-17340, CVE-2026-17408, CVE-2026-16720, CVE-2026-17278, CVE-2026-16884, CVE-2026-17336, CVE-2026-17117, CVE-2026-17150, CVE-2026-17402, CVE-2026-16920, CVE-2026-17049 - Affected: API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2 - Fixed in: v12.1.1.3 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026.json - This file: https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: IBM publishes Security Bulletin: Multiple Vulnerabilities in IBM API Connect. 202 CVEs addressed in API Connect V12 OnPrem by upgrading to v12.1.1.3; no workarounds. Affected: v12.1.0.0–v12.1.1.2. (https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39) - 2026-11-05: IBM announces API Connect v12.1.1.3 is available on Fix Central (the fixed release for this bulletin). (https://www.ibm.com/support/pages/node/7290205) ## Fix brief # Security brief: IBM API Connect V12 OnPrem: 202 CVEs fixed in v12.1.1.3 (tenant takeover, auth bypass, RCE, SQLi) Source: https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026 · status: live · severity: critical · updated Nov 7, 2026, 05:34 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is IBM published a security bulletin on Nov 5 2026 covering multiple vulnerabilities in IBM API Connect V12 OnPrem (v12.1.0.0 through v12.1.1.2), fixed by upgrading to v12.1.1.3. The bulletin lists 202 CVEs scored by IBM; 46 are critical (CVSS ≥ 9.0). Highlights include unauthenticated missing-authorization tenant create/modify/delete (CVE-2026-17362, CVSS 9.8), authentication bypass via improper cryptographic-signature verification (CVE-2026-17301, 9.8), hard-coded credentials giving full admin control (CVE-2026-17360, 9.8), unauthenticated path-traversal RCE (CVE-2026-17340, 9.8), OS command injection (CVE-2026-17408, 9.8), XXE (CVE-2026-16884, 9.9), and authenticated SQL injection / code-generation RCEs rated 9.9. IBM says there are no workarounds — upgrade to v12.1.1.3 via Fix Central. NVD detail pages for several of these IDs were not populated at first publication. Severity detail: IBM rates 46 of 202 CVEs critical (CVSS ≥ 9.0), including unauthenticated tenant takeover (CVE-2026-17362, 9.8), auth bypass, hard-coded credentials, RCE, XXE and SQLi; no workarounds - Product: IBM API Connect V12 OnPrem - CVE / advisory ids: CVE-2026-17362, CVE-2026-17301, CVE-2026-17313, CVE-2026-17360, CVE-2026-17340, CVE-2026-17408, CVE-2026-16720, CVE-2026-17278, CVE-2026-16884, CVE-2026-17336, CVE-2026-17117, CVE-2026-17150, CVE-2026-17402, CVE-2026-16920, CVE-2026-17049 ## Affected versions - API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - v12.1.1.3 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes On-prem API Connect V12 only (bulletin scope). Upgrade management/control plane to v12.1.1.3 from Fix Central; IBM lists no workarounds. Confirm version after upgrade. Cloud / SaaS API Connect is outside this bulletin — do not assume the same CVEs apply. ## Latest updates - Nov 5, 2026: IBM publishes Security Bulletin: Multiple Vulnerabilities in IBM API Connect. 202 CVEs addressed in API Connect V12 OnPrem by upgrading to v12.1.1.3; no workarounds. Affected: v12.1.0.0–v12.1.1.2. - Nov 5, 2026: IBM announces API Connect v12.1.1.3 is available on Fix Central (the fixed release for this bulletin). ## Advisories - [Security Bulletin: Multiple Vulnerabilities in IBM API Connect](https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39) (IBM) - [IBM API Connect v12.1.1.3 is now available](https://www.ibm.com/support/pages/node/7290205) (IBM) - [CVE-2026-17362 (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-17362) (CVE) --- Machine-readable: https://pwn.watch/i/ibm-api-connect-v12-1-1-3-security-bulletin-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.