IBM has published a security bulletin fixing more than 240 vulnerabilities in API Connect, its platform for managing application programming interfaces, including several rated critical that need no login at all to exploit.

The worst of them, tracked as CVE-2026-17362 and scored 9.8 out of 10, affects API Connect versions 12.1.0.0 through 12.1.1.2. IBM says a remote attacker could create, modify or delete tenants — the isolated customer environments inside a deployment — because an authorization check is missing. No username, password or user interaction is required.

Two further flaws in the same bulletin also score 9.8. One, CVE-2026-17360, allows a remote attacker to gain full administrative control through hard-coded credentials built into the product. The other, CVE-2026-17313, is an authentication bypass through an alternate path that could let an attacker take control of gateway configuration.

Several flaws score 9.9

A group of flaws scored 9.9, the highest in the bulletin, affects authenticated users. They include code execution through improperly controlled object attributes (CVE-2026-17117), command injection (CVE-2026-17402), and a path traversal flaw that allows arbitrary code execution (CVE-2026-17239). Another, CVE-2026-17292, could let a signed-in attacker take over ownership of organisations they do not control.

Other high-rated issues include an open redirect that could lead to account takeover (CVE-2026-17297, scored 9.6) and a flaw allowing arbitrary file reads and server-side request forgery (CVE-2026-17299, scored 9.6). Some of the flaws also affect the older 10.0.8 line, from 10.0.8.0 through 10.0.8.12.

No exploitation reported

IBM has not reported any exploitation of these flaws, and none of the sources seen for this report lists them in CISA's exploited-vulnerabilities catalogue. Administrators should apply the fixes in IBM's bulletin and review which of their deployments run the affected versions.