IBM API Connect: Arbitrary code execution (CVE-2026-105002)
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow arbitrary code execution in the management service due to improper control of generation of code.
CVE search metadata
CVE search record: CVE-2026-105002. Severity: high. CVSS: 7.5. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Arbitrary code execution (CVE-2026-105002). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-b3c95351/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 7, 05:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that could allow arbitrary code to be executed by the management service in certain non-default configurations. This is caused by improper control of generation of code, where customization content may be evaluated as code. This vulnerability is only possible where the related feature is enabled and not properly restricted.