{"id":"CVE-2026-17117","kind":"vulnerability","aliases":["CVE-2026-17117"],"related":[],"title":"IBM API Connect: logged-in user can set system-only fields and run code (fixed in 10.0.8.13 and 12.1.1.3)","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user change object fields that only the system should control. Setting those fields can lead to arbitrary code execution on the server.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["outside-affected-versions","unaffected-version","unauthenticated-only-access"],"how_to_check":"Check your API Connect version. Affected per IBM: 10.0.8.0 - 10.0.8.12 and API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. No special setting is required beyond a valid account.","fix":"Upgrade to 10.0.8.13 (10.0.8.x) or v12.1.1.3 (V12 OnPrem 12.1.x), via IBM Fix Central. IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","triaged_at":"2026-11-07T05:48:15+00:00","updated_at":"2026-11-07T06:00:18+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated user can set system-only fields, run code","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a logged-in user change object fields that only the system should control. Setting those fields can lead to arbitrary code execution on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Remote authenticated user runs arbitrary code on the server","analyst_note":"Find IBM's security bulletin for CVE-2026-17117 to confirm the fixed versions and any required setting.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- Confirm which API Connect deployments are reachable by user accounts from the internet or the local network","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","outside-affected-versions"],"who_is_affected":"Teams running IBM API Connect in the affected version ranges are exposed, provided their users can authenticate to the platform. The sources do not say which roles or features are needed beyond an authenticated account, so the exact exposure is unknown. Deployments outside the listed version ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":4258,"output_tokens":576,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17117 to confirm the fixed versions and any required setting.","search":"'-17117':24A,27A '-2026':23A,26A '10.0.8.0':54B,91C '10.0.8.12':56B,93C '10.0.8.13':19A '12.1.0.0':58B,95C '12.1.1.2':60B,97C '12.1.1.3':21A 'allow':99C 'api':2A,29A,32A,37B,44B,51B,89C 'api-connect':28A 'api-connect-v12-onprem':31A 'api-gateway':36B 'arbitrari':82B,106C 'attack':103C 'attribut':115C 'auth':40B 'auth-requir':39B 'authent':102C 'chang':67B 'code':16A,83B,107C,134C 'connect':3A,30A,33A,45B,52B,90C 'control':75B,111C,126C 'could':98C,118C,131C 'cve':22A,25A 'due':108C 'execut':84B,105C,135C 'field':13A,69B,78B,121C 'fix':17A 'gateway':38B 'host':48B 'ibm':1A,43B,50B,88C 'ibm-api-connect':42B 'improp':110C 'lead':80B,132C 'let':61B 'log':5A,64B 'logged-in':4A,63B 'modif':112C 'object':68B,114C 'onprem':35A 'remot':101C 'requir':41B 'run':15A 'self':47B 'self-host':46B 'server':87B 'set':9A,76B,119C 'system':11A,73B,129C 'system-on':10A 'user':7A,66B,117C 'v12':34A 'vendor':49B 'version':53B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 to 10.0.8.12 or V12 OnPrem 12.1.0.0 to 12.1.1.2. Any authenticated user can set an object field that only the system should control, which IBM says can lead to code execution (CWE-915, CVSS 9.9, changed scope), so exposure depends on who can hold an account. Teams on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T06:00:18Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1994},"products":{"at":"2026-11-07T06:00:18Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1994},"workarounds":{"at":"2026-11-07T06:00:18Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1994},"how_to_check":{"at":"2026-11-07T06:00:18Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1994},"who_affected":{"at":"2026-11-07T06:00:18Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1994}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17117':24A,27A '-2026':23A,26A '10.0.8.13':19A '12.1.1.3':21A 'api':2A,29A,32A 'api-connect':28A 'api-connect-v12-onprem':31A 'code':16A 'connect':3A,30A,33A 'cve':22A,25A 'field':13A 'fix':17A 'ibm':1A 'log':5A 'logged-in':4A 'onprem':35A 'run':15A 'set':9A 'system':11A 'system-on':10A 'user':7A 'v12':34A","search_b":"'10.0.8.0':54B '10.0.8.12':56B '12.1.0.0':58B '12.1.1.2':60B 'api':37B,44B,51B 'api-gateway':36B 'arbitrari':82B 'auth':40B 'auth-requir':39B 'chang':67B 'code':83B 'connect':45B,52B 'control':75B 'execut':84B 'field':69B,78B 'gateway':38B 'host':48B 'ibm':43B,50B 'ibm-api-connect':42B 'lead':80B 'let':61B 'log':64B 'logged-in':63B 'object':68B 'requir':41B 'self':47B 'self-host':46B 'server':87B 'set':76B 'system':73B 'user':66B 'vendor':49B 'version':53B","search_c":"'10.0.8.0':91C '10.0.8.12':93C '12.1.0.0':95C '12.1.1.2':97C 'allow':99C 'api':89C 'arbitrari':106C 'attack':103C 'attribut':115C 'authent':102C 'code':107C,134C 'connect':90C 'control':111C,126C 'could':98C,118C,131C 'due':108C 'execut':105C,135C 'field':121C 'ibm':88C 'improp':110C 'lead':132C 'modif':112C 'object':114C 'remot':101C 'set':119C 'system':129C 'user':117C","first_public_at":"2026-11-07T05:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17117","severity":null,"published_at":"2026-11-07T05:18:25+00:00","modified_at":"2026-11-07T05:18:25+00:00","first_seen_at":"2026-11-07T05:45:58+00:00","fetched_at":"2026-11-07T05:45:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17117:1994","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T06:00:18+00:00","modified_at":"2026-11-07T06:00:18+00:00","first_seen_at":"2026-11-07T06:00:18+00:00","fetched_at":"2026-11-07T06:00:18+00:00","note":"Read IBM bulletins -41 (10.0.8.x, fix 10.0.8.13) and -39 (V12 OnPrem, fix v12.1.1.3); both list CVE-2026-17117, workarounds None. No exploitation/PoC evidence checked beyond bulletins; no social search.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}