critical advisory November 7, 2026

IBM API Connect: Path traversal vulnerability (CVE-2026-17339)

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal vulnerability that permits a remote authenticated attacker to perform unauthorized access or deletion of resources belonging to other tenants.

Triage facts

Revision 1

Applicability: API Connect (12.1.0.0 through 12.1.1.2)
Evidence: Unknown
Severity: Critical
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 7, 05:54 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a path traversal vulnerability. This flaw allows a remote, authenticated attacker to manipulate API requests to access or delete resources belonging to other tenants within the multi-tenant environment.

Impact

Successful exploitation allows for unauthorized cross-tenant data access and the potential destruction of sensitive API resources, leading to a loss of data confidentiality and integrity.

Recommendation

Inventory all deployments of IBM API Connect to identify instances running versions 12.1.0.0 through 12.1.1.2.
Monitor vendor channels for the release of security patches or configuration workarounds for CVE-2026-17339.
Implement strict request validation and object-level authorization checks at the API gateway layer for all tenant-specific endpoints until updates are applied.

Immediate actions

Inventory IBM API Connect deployments to identify vulnerable versions 12.1.0.0-12.1.1.2.

IT Operations 24h

Threat Hunt

Monitor API gateway access logs for path traversal patterns (e.g., ../, ..%2f) targeting resource identifiers.

T1190 medium medium confidence hunt now

Data: Web server or API gateway access logs

Mitigations

Apply vendor patches for CVE-2026-17339 as soon as they become available.

immediate IT Operations

CVE-2026-17339