Vulnerability Details CVE-2026-17287
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 31.6%
CVSS Severity
CVSS v3 Score 8.5
References
Products affected by CVE-2026-17287
-
cpe:2.3:a:ibm:api_connect:10.0.8.0
-
cpe:2.3:a:ibm:api_connect:10.0.8.10
-
cpe:2.3:a:ibm:api_connect:10.0.8.5