MajorCritical vulnerability

CVE-2026-19121 (CVSS 8.3)

NVD · officialPublished Nov 7, 2026Risk 37/100EPSS 0.4%

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.

Technical details

CVSS

8.3

AV:NetworkAC:LowPR:LowUI:NoneC:HighI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source