CVE-2026-17410: Multi-tenant bypass in IBM API Connect

CVE-2026-17410 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw resides in improper neutralization of argument delimiters that allows an authenticated attacker to bypass multi-tenant isolation controls. Critical consequence: a legitimate user on one organization can access and modify portal data of other organizations, severely compromising multi-tenant segregation.

The assigned CVSS score is 9.9 (critical). Although the flaw requires prior authentication, impact is very high as it enables access to and modification of data belonging to other tenants. The CVE was published on 2026-11-07 on NVD. Official data reports no confirmed public exploit, however CVE release has already generated social media attention (30 interactions on X within first 24 hours, with signals consistent between NVD and social reports).

Security teams and administrators must immediately prioritize verification of API Connect versions in their environment. Contact IBM directly for patch availability and release timeline. In the interim, implement enhanced monitoring of cross-tenant access through audit log analysis, verify modification history across organizations, segment the network to restrict communication between different tenant environments, and apply least privilege principles to access roles and permissions.