IBM API Connect: Remote code execution via object attribute modification (CVE-2026-17117)
An improper control of object attributes in IBM API Connect allows a remote authenticated attacker to modify system-reserved fields, leading to arbitrary code execution.
CVE search metadata
CVE search record: CVE-2026-17117. Severity: critical. CVSS: 9.9. KEV: no. Product: API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2). Brief: IBM API Connect: Remote code execution via object attribute modification (CVE-2026-17117). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce/
Triage facts
Revision 1- Applicability
- API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-17117 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows an authenticated remote user to manipulate object attributes that are intended to be restricted to system use. Successful exploitation enables the execution of arbitrary code within the context of the affected application.
Impact
Successful exploitation allows for remote code execution by authenticated users, potentially leading to full system compromise of the API Connect instance.
Recommendation
- Inventory IBM API Connect instances to identify versions within the 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 ranges.
- Review IBM security bulletins for the release of fixed firmware or software updates and prioritize patching of internet-facing instances.
- Monitor authentication logs for suspicious administrative activity or unauthorized API call patterns targeting object configuration endpoints.
Immediate actions
Identify all instances of IBM API Connect and verify current versioning against the vulnerability range.
Threat Hunt
Identify authenticated sessions performing unusual configuration changes or POST/PUT requests to object management endpoints.
Data: API Connect application audit logs, Administrative access logs
Mitigations
Apply security patches provided by IBM as soon as they become available for the identified affected versions.
CVE-2026-17117