What is CVE-2026-17085?

CVE-2026-17085 is a medium-severity vulnerability in IBM API Connect, classified under Improper Handling of Case Sensitivity. CVSS score: 4.1/10. Published 2026-11-07.

How severe is CVE-2026-17085?

Medium severity. CVSS v3 base score is 4.1 out of 10.

Vulnerability in IBM API Connect

CVE-2026-17085

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.

Published 2026-11-07 · last modified 2026-11-07.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.004 (36.6th percentile), scored 2026-11-09.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

IBM API Connect

Weakness classification (CWE)

CWE-178 — Improper Handling of Case Sensitivity

References

www.ibm.com/support/pages/node/7295635 (vendor-advisory, patch)
www.ibm.com/support/pages/node/7295637 (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-17085?: CVE-2026-17085 is a medium-severity vulnerability in IBM API Connect, classified under Improper Handling of Case Sensitivity. CVSS score: 4.1/10. Published 2026-11-07.
How severe is CVE-2026-17085?: Medium severity. CVSS v3 base score is 4.1 out of 10.