IBM API Connect CVE-2026-16920

Exploitation requires the attacker to already possess valid authenticated credentials on an IBM API Connect instance in the 12.1.0.0 through 12.1.1.2 range (PR:L), reachable over the network (AV:N), with no user interaction (UI:N) and low attack complexity (AC:L). The limiting factor is this authentication requirement - the attacker must first obtain a low-privilege account - but no special non-default configuration, platform, or feature toggle is named in the description as a prerequisite; the precise feature or protocol path that enables the confused-deputy behavior is not described in the available sources. Deployments restricted to trusted internal users or with no untrusted account provisioning reduce realistic exposure.

This is a genuine high-priority issue, though the public data is thin. The vendor-supplied CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L), with a scope change (S:C) and high confidentiality, integrity, and availability impact - consistent with a confused-deputy (CWE-441) weakness where an already-authenticated, limited-privilege user coaxes a more-privileged component into acting on their behalf, crossing a trust boundary. The vuln.today decision label is act_now and IBM has published a patch, which raises urgency. However, the signals are not fully corroborated: no EPSS probability is supplied, there is no CISA KEV listing, and no public PoC or exploit reference is provided, so there is no public exploit identified at time of analysis. The absence of EPSS/KEV means exploitation likelihood cannot be quantified from the input and should not be inferred; the high score reflects potential impact and ease given valid credentials, not evidence of mass exploitation. The description is terse and does not state the exact mechanism, affected feature, or which security restriction is bypassed, so the scope-change and full CIA impact ratings are vendor assertions that cannot be independently verified from the available sources.

A remote attacker who already holds valid low-privilege credentials on an IBM API Connect deployment (12.1.0.0-12.1.1.2) sends requests that cause a trusted internal component to perform privileged actions on the attacker's behalf, bypassing intended security restrictions. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, no user interaction or elevated privileges are needed beyond initial authentication, and the trigger is not described in the available sources. No public exploit identified at time of analysis.