← Vulnerability feed

Vulnerability record · CVE-2026-16884 · published 7 November 2026

CVE-2026-16884: Ibm api connect xml external entity (xxe) vulnerability

Ibm · Api Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

9.9 CVSS 3.1 Critical EPSS 0.50% · top 56.9% CWE-611 · XML external entity (XXE)
9.9CVSS 3.1 base score
0.50%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
11 Nov 2026Last modified by NVD

Description

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7295635 Vendor Advisory

Track CVE-2026-16884 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2026-17150Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and ac…EPSS 0.80%9.9CVE-2026-17049Ibm api connect insecure direct object reference vulnerabilityIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents …EPSS 0.51%9.9CVE-2026-16920Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulner…EPSS 0.50%9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.9CVE-2018-1712Ibm api connect cross-site request forgery vulnerabilityIBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input p…EPSS 0.71%9.8CVE-2026-17301Ibm api connect improper verification of cryptographic signature vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to impr…EPSS 0.41%9.8CVE-2026-16720Ibm api connect improper authentication vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users …EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2026-16884), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.