CVE-2026-19126

MediumCVSS 5.9/10Last modified Nov 8, 2026

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-916

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
IBM	API Connect	>= 12.1.0.0, <= 12.1.1.2; >= 10.0.8.0, <= 10.0.8.12

References

Timeline

Published: Nov 7, 2026
Last modified: Nov 8, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-191276.5An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting in CVE-2026-191287.5IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-CVE-2026-191296.8IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data CVE-2026-19136.4The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all CVE-2026-191305.8A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the CVE-2026-191316.5IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing CVE-2026-191338.1IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due CVE-2026-191346.5A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. This issue affects OpenText Directory CVE-2026-191355.4A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit CVE-2026-191367.8A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese marke CVE-2026-191378.3Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce CVE-2026-191388.3Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p