home / blog
2026-11-07 · critical
CVE-2026-17399: RCE in IBM API Connect 10.0.8 and 12.1
Insufficient validation in IBM API Connect 10.0.8 and 12.1 allows remote code execution (CVSS 9.9).
CVE-2026-17399 concerns a validation flaw in uploaded content on IBM API Connect, specifically in versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2. When an authenticated user uploads content, the platform fails to validate it properly before processing, allowing arbitrary code execution directly on the server. This affects any organization using API Connect to manage API gateways and enterprise integrations.
The CVSS score is 9.9 (Critical), accessible from authenticated users but with maximum impact on system availability, integrity and confidentiality. The CVE was published on 2026-11-07, indicating extreme freshness. On X there is 1 post in the last 24 hours with 31 total interactions, but no confirmed active or public exploits in verifiable data.
Immediately verify whether your infrastructure uses IBM API Connect in vulnerable versions. Prioritize updating to patched versions once available. Until patching, implement strict access controls on content uploads, active monitoring of who and what is uploaded, and isolation of critical gateways. Enable audit logging on all upload operations.
At a glance
- What
- A validation flaw in uploaded content on IBM API Connect allows arbitrary code execution from authenticated users.
- Severity
- CVSS 9.9 (Critical) - Maximum impact on confidentiality, integrity and availability of servers.
- Affected versions
- IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2
- Fix
- Not reported in available NVD data; consult official IBM advisory for specific patches.
- Status
- CVE published 2026-11-07; signals of discussion on social media (1 post in 24h), no confirmed active exploitation in data.
- Action
- Check for vulnerable versions; prioritize update; implement access controls on uploads; monitor audit logs.
Sources: NVD, CVE-2026-17399