IBM API Connect: Remote authenticated code execution (CVE-2026-17399)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authenticated remote code execution vulnerability identified as CVE-2026-17399. The flaw originates from the application's failure to adequately validate content prior to processing uploaded files. A remote authenticated attacker can leverage this to trigger arbitrary code execution on the underlying server.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the IBM API Connect software. This grants the attacker potential control over the application environment and the ability to access or manipulate data managed by the API gateway.

Recommendation

• Identify all instances of IBM API Connect in the infrastructure and verify the version numbers against the affected ranges.
• Apply the latest vendor security patches provided by IBM to remediate CVE-2026-17399.
• Restrict administrative or file-upload access to the IBM API Connect management interfaces to trusted users only to minimize the risk of exploitation by compromised credentials.