CVE-2026-17150
Multiple Vulnerabilities in IBM API Connect
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
| CWE | CWE-184 |
| Vendor | ibm |
| Product | api connect |
| Published | Nov 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for ibm api connect
Be the first to know when new critical vulnerabilities affecting ibm api connect are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
IBM / API Connect
12.1.0.0 ≤ 12.1.1.2 10.0.8.0 ≤ 10.0.8.12