Vulnerability Details CVE-2026-17190
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 38.3%
CVSS Severity
CVSS v3 Score 8.7
References
Products affected by CVE-2026-17190
-
cpe:2.3:a:ibm:api_connect:10.0.8.0
-
cpe:2.3:a:ibm:api_connect:10.0.8.10
-
cpe:2.3:a:ibm:api_connect:10.0.8.5