InfoSecBulletin Cybersecurity for mankind
IBM patched 208 security flaws in its API Connect platform. The CVE records released out on November 7, 2026. Among these flaws, 47 are critical and 94 are high. Some of them let attackers run code remotely or get around login checks.
API Connect versions 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2 have flaws that rate as high as CVSS 9.9. Unauthenticated attackers can skip logins, run commands, or take admin control using hard-coded passwords. IBM also fixed another problem rated 9.8 in Aspera Faspex.
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
No login required
CVE-2026-17301 (CVSS 9.8) might let “a hacker skip authentication.” This happens because the software doesn’t check a cryptographic signature properly. Also, CVE-2026-17360 gives “full admin access because of hard-coded passwords.” Other serious bugs, CVE-2026-17408 and CVE-2026-17340, let users run code by injecting commands and messing with paths. At the same time, CVE-2026-17313 allows hackers to “change gateway settings.”
Authenticated attacks
A second group with a score of 9.9 needs a real account. For instance, CVE-2026-17402 lets someone run commands on the OS. Also, CVE-2026-17392 uses LDAP injection to get admin access to other users. CVE-2026-17410 allows users to “view and change other users’ portal data.”
Aspera Faspex
Separately, CVE-2026-123218 affects Aspera Faspex 5.0.0 through 5.0.19. It could let a user craft a message to “gain full administrative privileges.”
Affected Versions
IBM API Connect 10.0.8.0 through 10.0.8.12
IBM API Connect 12.1.0.0 through 12.1.1.2
IBM Aspera Faspex 5.0.0 through 5.0.19
Most of the IBM API Connect vulnerabilities hit both branches. However, 73 affect only the 12.1 line.
Patch and Mitigation
Apply the fixes in IBM’s security bulletins for API Connect and Aspera Faspex.
Restrict management and gateway interfaces to trusted networks until you patch.
Limit outbound traffic from API Connect hosts to reduce SSRF risk.
Review tenant and admin accounts for changes you did not make.
Related News:
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
