Hard-Coded Cryptographic Key Vulnerability in IBM API Connect
CVE-2026-19124

6.8MEDIUM

Key Information:

Vendor

IBM
Status
Api Connect
Vendor
CVE Published:
7 November 2026

What is CVE-2026-19124?

IBM API Connect versions 10.0.8.0 through 10.0.8.12 are impacted by a vulnerability that stems from the implementation of a hard-coded cryptographic key. This key is used to secure stored credentials within the product. In scenarios where an attacker gains access to stored data, they may exploit this vulnerability to decrypt sensitive credentials, thereby compromising data security and user confidentiality. Organizations utilizing impacted versions should consider reviewing their deployment and applying necessary patches to mitigate risks associated with this vulnerability.

Affected Version(s)

API Connect 10.0.8.0 <= 10.0.8.12

References

https://www.ibm.com/support/pages/node/7295637
vendor-advisorypatch

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.