Cross-Site Scripting Vulnerability in IBM API Connect Products
CVE-2026-17390

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-17390?

A vulnerability in IBM API Connect enables an authenticated user to execute arbitrary JavaScript in the web user interface due to improper input validation. This could potentially manipulate the page’s functionality and expose sensitive information, such as user credentials, during a trusted session. Patching is essential to mitigate risks associated with this ongoing threat.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

API Connect 10.0.8.0 <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch
https://www.ibm.com/support/pages/node/7295637
vendor-advisorypatch

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.