IBM API Connect: Path traversal remote code execution (CVE-2026-17147)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability (CVE-2026-17147). This flaw enables an authenticated remote attacker to bypass intended file system restrictions, potentially leading to arbitrary code execution and the performance of unauthorized administrative functions within the API Connect environment.

Impact

Authenticated remote attackers can gain unauthorized administrative control over the API management environment and execute arbitrary code on the underlying infrastructure.

Recommendation

• Inventory all instances of IBM API Connect within the environment to identify versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2.
• Apply the vendor-provided security patches or upgrade to a remediated version of API Connect as specified in official IBM security advisories.
• Restrict administrative interface access to known, trusted IP addresses and implement robust multi-factor authentication (MFA) to minimize the impact of compromised administrative credentials.