IBM API Connect: Arbitrary file overwrite vulnerability (CVE-2026-16714)
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that could allow a remote attacker to overwrite arbitrary files on the system.
CVE search metadata
CVE search record: CVE-2026-16714. Severity: high. CVSS: 7.5. KEV: no. Product: API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2). Brief: IBM API Connect: Arbitrary file overwrite vulnerability (CVE-2026-16714). Brief link: https://feed.craftedsignal.io/briefs/2026-11-api-connect-traversal/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0 through 10.0.8.12, 12.1.0.0 through 12.1.1.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 06:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
IBM API Connect contains a path traversal vulnerability in specific versions (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2). This flaw allows a remote attacker to overwrite arbitrary files on the underlying file system. No exploit path or proof-of-concept is currently documented by the source.
Recommendation
- Audit all internet-facing instances of IBM API Connect to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.
- Review official vendor security advisories from IBM for patch availability and apply the corresponding update to the affected API Connect components.
- Monitor web server access logs for anomalous directory traversal patterns, such as sequences including '../', '%2e%2e/', or equivalent encoding, targeted at API management endpoints.
Immediate actions
Inventory IBM API Connect deployments and compare versions against the affected ranges.
Threat Hunt
Identify HTTP requests containing traversal sequences aimed at API Connect management interfaces.
Data: Web server access logs
Mitigations
Apply vendor-provided patches for CVE-2026-16714 once available.
CVE-2026-16714