IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.
CVE search metadata
CVE search record: CVE-2026-17150. Severity: critical. CVSS: 9.9. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-17150 describes a vulnerability in IBM API Connect resulting from insufficient input validation of uploaded custom modules. An authenticated remote attacker can exploit this flaw to execute arbitrary code within the application environment. Due to the nature of the vulnerability, successful exploitation enables a tenant to bypass security boundaries, potentially accessing sensitive information belonging to other tenants.
Impact
Successful exploitation allows for arbitrary code execution on the server hosting the API Connect instance and enables cross-tenant data access, compromising the confidentiality and integrity of all tenants within the affected environment.
Recommendation
- Audit all current custom module deployments within the IBM API Connect environment to identify any unauthorized or suspicious modifications.
- Prioritize upgrading to the latest patched version of IBM API Connect as released by IBM.
- Review access logs for API endpoints associated with module uploads and management to identify unauthorized authentication or anomalous administrative activity.
Immediate actions
Patch IBM API Connect to the version recommended by the vendor to remediate CVE-2026-17150.
Threat Hunt
Identify abnormal or unauthorized custom module uploads via API Connect management interfaces.
Data: API audit logs, File system change logs for custom module storage directories
Mitigations
Upgrade to patched version of IBM API Connect.
CVE-2026-17150