IBM patches 208 API Connect vulnerabilities, 47 critical, plus a 9.8 Aspera Faspex authorization bypass
IBM disclosed 208 vulnerabilities in API Connect, with CVE records published on 7 November 2026; 47 are rated critical and 94 high. The flaws affect API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, with CVSS scores up to 9.9, and include unauthenticated authentication bypass, OS command injection, path traversal, hard-coded credentials and cross-tenant access in shared deployments. IBM separately fixed CVE-2026-123218 (CVSS 9.8) in Aspera Faspex 5.0.0 through 5.0.19, where an authorized user can craft a message to gain full administrative privileges. No exploitation in the wild has been confirmed and no public exploit code or attack traffic has been reported. The operational risk is driven by the few pre-authentication flaws and by the exposure of API gateways; most of the 9.9-rated issues require a valid account, which limits them to tenants and insiders in multi-tenant estates.
Entenda a falha
A vulnerabilidade
IBM disclosed 208 flaws in API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2; 47 are critical, with CVSS up to 9.9. Pre-authentication ones: CVE-2026-17301 (9.8, authentication bypass via improper cryptographic signature verification), CVE-2026-17360 (hard-coded credentials giving full admin control), CVE-2026-17408 and CVE-2026-17340 (code execution via OS command injection and path traversal) and CVE-2026-17313 (control of gateway configuration). The 9.9 group needs a valid account: CVE-2026-17402 (OS command injection), CVE-2026-17392 (LDAP injection to get admin on other tenants) and CVE-2026-17410 (access to and modification of other tenants' portal data). Separately, CVE-2026-123218 (9.8) in Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a message to gain full admin privileges. Fixed in API Connect 10.0.8.13, 12.1.1.3 and Aspera Faspex 5.0.19 PL1.
Como funciona
The articles give no step-by-step internals, only the flaw classes. In the pre-authentication cases, a request reaches the API Connect management or gateway interface and the software either fails to properly verify a cryptographic signature, or accepts built-in hard-coded credentials, so access is granted without a legitimate login. In the injection cases, attacker-controlled input is passed on to the operating system, file paths or an LDAP query without being safely handled, so it is interpreted as commands, paths or query logic. In the cross-tenant cases, an authenticated user's request touches objects belonging to another tenant. In Aspera Faspex, a crafted message from an authorized user ends in admin privileges.
Por que é vulnerável
The root causes are classic ones: improper verification of a cryptographic signature (CVE-2026-17301), hard-coded credentials and hard-coded cryptographic keys, unsanitized input reaching OS commands, file paths and LDAP queries, and missing authorization checks between tenants (broken object-level authorization). Server-side request forgery is the most common class, with about 40 entries. IBM's bulletins confirm the pattern of authenticated SSRF, broken object-level authorization and hard-coded key issues. The articles do not explain why the flaws went unnoticed; the fixed releases remove them.
Como foi descoberta
IBM disclosed the flaws through security bulletins dated 5 November 2026, and the CVE records were published on 7 November 2026. The Aspera Faspex flaw was reported by Positive Technologies. The articles do not say how the API Connect flaws were found, and no exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 23:17.
Detalhes técnicos
CVE-2026-17301 (CVSS 9.8) allows an unauthenticated attacker to bypass authentication through improper verification of a cryptographic signature, and CVE-2026-17360 grants full administrative control through hard-coded credentials. CVE-2026-17408 and CVE-2026-17340 allow code execution via OS command injection and path traversal, while CVE-2026-17313 lets an attacker take control of gateway configuration. A second group rated 9.9 requires a valid account: CVE-2026-17402 (OS command injection), CVE-2026-17392 (LDAP injection to gain admin access to other tenants) and CVE-2026-17410 (access and modification of other tenants' portal data). Server-side request forgery is the most common class, with about 40 entries. Most issues affect both branches; 73 are specific to the 12.1 line. IBM's own bulletins confirm the pattern of authenticated SSRF, broken object-level authorization and hard-coded cryptographic key issues, and rate CVE-2026-17410 at 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) (ibm.com). The Aspera Faspex flaw was reported by Positive Technologies (vulners.com).
Detalhes da correção
IBM's security bulletins name the remediated releases: API Connect 10.0.8.13 for the 10.0.8 branch and API Connect v12.1.1.3 for the 12.1 branch (ibm.com, support pages 7295637 and 7295635, dated 5 November 2026). For Aspera Faspex, the fix ships in 5.0.19 PL1 (ibm.com, support page 7295921). No pull request or commit is applicable: API Connect and Aspera Faspex are closed-source products distributed through IBM Fix Central.
Remediação
Apply the fixes in IBM's security bulletins for API Connect (10.0.8.13 / 12.1.1.3) and Aspera Faspex (5.0.19 PL1). Until patched, restrict management and gateway interfaces to trusted networks, limit outbound traffic from API Connect hosts to reduce SSRF exposure, and review tenant and administrative accounts for unexplained changes.
Linha do tempo
-
IBM patches 208 API Connect vulnerabilities, 47 critical, plus a 9.8 Aspera Faspex authorization bypass
ler a análise desta fonte ocultar
IBM disclosed 208 vulnerabilities in API Connect, with CVE records published on 7 November 2026; 47 are rated critical and 94 high. The flaws affect API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2, with CVSS scores up to 9.9, and include unauthenticated authentication bypass, OS command injection, path traversal, hard-coded credentials and cross-tenant access in shared deployments. IBM separately fixed CVE-2026-123218 (CVSS 9.8) in Aspera Faspex 5.0.0 through 5.0.19, where an authorized user can craft a message to gain full administrative privileges. No exploitation in the wild has been confirmed and no public exploit code or attack traffic has been reported. The operational risk is driven by the few pre-authentication flaws and by the exposure of API gateways; most of the 9.9-rated issues require a valid account, which limits them to tenants and insiders in multi-tenant estates.
Technical Details
CVE-2026-17301 (CVSS 9.8) allows an unauthenticated attacker to bypass authentication through improper verification of a cryptographic signature, and CVE-2026-17360 grants full administrative control through hard-coded credentials. CVE-2026-17408 and CVE-2026-17340 allow code execution via OS command injection and path traversal, while CVE-2026-17313 lets an attacker take control of gateway configuration. A second group rated 9.9 requires a valid account: CVE-2026-17402 (OS command injection), CVE-2026-17392 (LDAP injection to gain admin access to other tenants) and CVE-2026-17410 (access and modification of other tenants' portal data). Server-side request forgery is the most common class, with about 40 entries. Most issues affect both branches; 73 are specific to the 12.1 line. IBM's own bulletins confirm the pattern of authenticated SSRF, broken object-level authorization and hard-coded cryptographic key issues, and rate CVE-2026-17410 at 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) (ibm.com). The Aspera Faspex flaw was reported by Positive Technologies (vulners.com).
Fix Details
IBM's security bulletins name the remediated releases: API Connect 10.0.8.13 for the 10.0.8 branch and API Connect v12.1.1.3 for the 12.1 branch (ibm.com, support pages 7295637 and 7295635, dated 5 November 2026). For Aspera Faspex, the fix ships in 5.0.19 PL1 (ibm.com, support page 7295921). No pull request or commit is applicable: API Connect and Aspera Faspex are closed-source products distributed through IBM Fix Central.
Remediation
Apply the fixes in IBM's security bulletins for API Connect (10.0.8.13 / 12.1.1.3) and Aspera Faspex (5.0.19 PL1). Until patched, restrict management and gateway interfaces to trusted networks, limit outbound traffic from API Connect hosts to reduce SSRF exposure, and review tenant and administrative accounts for unexplained changes.