{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-17150/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-17150"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["API Connect (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-17150","rce","tenant-isolation","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-17150 describes a vulnerability in IBM API Connect resulting from insufficient input validation of uploaded custom modules. An authenticated remote attacker can exploit this flaw to execute arbitrary code within the application environment. Due to the nature of the vulnerability, successful exploitation enables a tenant to bypass security boundaries, potentially accessing sensitive information belonging to other tenants.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the API Connect instance and enables cross-tenant data access, compromising the confidentiality and integrity of all tenants within the affected environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all current custom module deployments within the IBM API Connect environment to identify any unauthorized or suspicious modifications.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version of IBM API Connect as released by IBM.\u003c/li\u003e\n\u003cli\u003eReview access logs for API endpoints associated with module uploads and management to identify unauthorized authentication or anomalous administrative activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:50:54Z","date_published":"2026-11-07T05:50:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allow remote authenticated attackers to execute arbitrary code and access other tenants due to insufficient validation of custom module uploads.","title":"IBM API Connect: Remote code execution and tenant isolation bypass (CVE-2026-17150)","url":"https://feed.craftedsignal.io/briefs/2026-11-ibm-api-connect-rce-66d684dd/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-17150","version":"https://jsonfeed.org/version/1.1"}