IBM API Connect: hard-coded administrative credentials, unauthenticated command injection and authentication bypass among the CVEs fixed in v12.1.1.3 and 10.0.8.13

IBM's security bulletins of 2026-11-05 for API Connect, its API management platform, list more than two hundred CVEs, and 18 rows of the v12 bulletin need no privileges at CVSS 3.1 9.0 or higher; among them is CVE-2026-17360, through which a remote attacker can gain full administrative control because of hard-coded credentials, scored CVSS 3.1 9.8 on the v12 bulletin (IBM, 2026-11-05). The same bulletin lists, each at 9.8 with no privileges or user interaction, OS command injection to arbitrary code execution (CVE-2026-17408), path traversal to arbitrary code execution (CVE-2026-17340), an authentication bypass through improper verification of a cryptographic signature (CVE-2026-17301), valid access tokens for other users because authentication against a connected directory service is not sufficiently enforced (CVE-2026-16720), and missing authorization that lets a remote attacker create, modify or delete tenants (CVE-2026-17362); a second hard-coded credential row, CVE-2026-17403, scores 9.0 (IBM, 2026-11-05). The V10.0.8 bulletin carries CVE-2026-17403, CVE-2026-17408, CVE-2026-17301 and CVE-2026-16720 as well (IBM, 2026-11-05).

API Connect V12 on-premises v12.1.0.0 to v12.1.1.2 is fixed in v12.1.1.3 and V10.0.8.0 to 10.0.8.12 in 10.0.8.13; IBM lists no workaround or mitigation on either page (IBM, 2026-11-05; IBM, 2026-11-05). Neither bulletin mentions exploitation, and neither says which component each flaw sits in.