Server-Side Request Forgery in IBM API Connect Affects Multiple Versions
CVE-2026-19122

3.8LOW

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-19122?

An identified vulnerability in IBM API Connect versions 12.1.0.0 to 12.1.1.2 could allow an authenticated privileged attacker to exploit server-side request forgery (SSRF). This weakness enables the attacker to send unauthorized requests, which may facilitate enumeration of network resources or subsequent attacks. Organizations utilizing affected versions should review the advisory provided by IBM for further details and recommended mitigation strategies.

Affected Version(s)

API Connect 12.1.0.0 <= 12.1.1.2

References

https://www.ibm.com/support/pages/node/7295635
vendor-advisorypatch

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.