IBM has disclosed 208 vulnerabilities in API Connect, including 47 rated critical and 94 rated high, with CVE records published on November 7. Scores reach CVSS 9.9, and several flaws allow remote code execution or authentication bypass without a login. A separate 9.8-rated flaw was also fixed in Aspera Faspex.
Scope of the IBM API Connect Advisory
The affected releases are API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. IBM has released fixes, and administrators are expected to apply updates to API Connect and to Aspera Faspex.
No exploitation has been confirmed. OffSeq reports that no public exploit exists for at least one of the flaws. The volume itself is unusual: more than 200 CVEs from a single release puts a heavy load on the teams that must triage them.
Unauthenticated Flaws Including CVE-2026-17301 and CVE-2026-17360
Several of the most serious flaws require no login. CVE-2026-17301, scored 9.8, is an authentication bypass caused by improper cryptographic signature verification. CVE-2026-17360 allows full administrative control through hard-coded credentials. CVE-2026-17408 and CVE-2026-17340, both 9.8, are an OS command injection and a path traversal respectively. CVE-2026-17313 allows takeover of a gateway configuration.
The 9.9 Group Requires a Valid Account
A separate group scoring 9.9 needs an authenticated account. One example is CVE-2026-17402, an OS command injection. The score exceeds that of the unauthenticated flaws because of the scope of what an authenticated attacker can reach, though the source does not detail the scoring rationale.
Tenant Boundaries in Shared Deployments
Many of the bugs cross tenant boundaries in shared deployments. API gateways typically sit between external clients and internal services, so they hold tenant data and connections into internal networks. A flaw that lets one tenant reach another, or an unauthenticated visitor reach the gateway’s configuration, therefore has consequences beyond the gateway itself.
Separate 9.8 Flaw in Aspera Faspex
IBM also fixed a separate 9.8-rated vulnerability in Aspera Faspex, its file transfer product. The source does not give the CVE number or mechanism. The product’s inclusion in the same disclosure means organizations using both IBM products have two sets of updates to apply.
What the Disclosure Leaves Unanswered
The numbers invite questions the sources do not answer: how IBM found so many flaws in one release, whether the discovery came from an internal audit, external reports or automated analysis, and why the records were published together. The sources also do not say whether IBM expects any of the flaws to be targeted.
Practitioners reading the list will note that a quarter of the entries are rated critical, and that the mix of hard-coded credentials, command injection and signature verification failures covers several distinct classes of weakness rather than one repeated bug. That variety points to a broad code review or audit effect, though IBM has not said so. The central fact is more limited: the advisory is large, the fixes exist, and exploitation has not been confirmed. Organizations running the listed versions face a long remediation list and no public indication yet of attacks.
Triage Burden and the Absence of Exploitation Evidence
Handling 208 vulnerabilities in a single advisory is a significant task for any security team. The split of 47 critical and 94 high means 141 flaws rate at the top two severity bands, leaving 67 in the lower tiers. Teams must decide the order in which to patch, and the advisory’s notes help: flaws that need no login present a different risk from those requiring a valid account.
The unauthenticated group includes the signature verification bypass and hard-coded credential issue. The authenticated 9.9 group is more dangerous in shared deployments, because a tenant with a valid account could use a command injection flaw such as CVE-2026-17402 to reach beyond its own boundary.
OffSeq’s report that no public exploit exists for at least one of the flaws is the only indication of exploit status in the coverage, and it applies to a single flaw. No exploitation is confirmed for the set as a whole.
