{"id":"CVE-2026-17147","kind":"vulnerability","aliases":["CVE-2026-17147"],"related":[],"title":"IBM API Connect V12 OnPrem: path traversal lets authenticated user run code","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can execute arbitrary code and perform unauthorized administrative actions.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your API Connect V12 OnPrem version: affected if it is v12.1.0.0 through v12.1.1.2. Also check any 10.0.8.x install (10.0.8.0-10.0.8.12), which NVD lists but IBM's bulletin for this CVE does not confirm.","fix":"Upgrade API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","triaged_at":"2026-11-07T05:48:11+00:00","updated_at":"2026-11-07T05:59:22+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-07T05:48:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: path traversal lets authenticated attacker run code","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can execute arbitrary code and perform unauthorized administrative actions.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code and performs administrative actions on the server","analyst_note":"Find IBM's security bulletin for CVE-2026-17147 to confirm fixed versions and any required configuration; the NVD entry alone gives no fix.","how_to_check":"- Check the installed IBM API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- Confirm the version from the product's admin console or installation records; the sources do not name a command","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM API Connect in the affected version ranges, where remote users hold authenticated accounts. The sources do not state which deployment roles or configurations are needed, so it is unknown whether managed or default setups are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000705,"input_tokens":4242,"output_tokens":562,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17147 to confirm fixed versions and any required configuration; the NVD entry alone gives no fix.","search":"'-17147':15A,18A '-2026':14A,17A '10.0.8.0':38B,69C '10.0.8.12':40B,71C '12.1.0.0':42B,73C '12.1.1.2':44B,75C 'account':56B 'action':65B,90C 'administr':64B,89C 'allow':77C 'api':2A,19A,24B,28B,35B,67C 'api-gateway':23B 'arbitrari':59B,84C 'attack':52B,81C 'authent':9A,80C 'code':12A,60B,85C 'connect':3A,20A,29B,36B,68C 'contain':45B 'could':76C 'cve':13A,16A 'due':91C 'execut':58B,83C 'flaw':49B 'gateway':25B 'host':32B 'ibm':1A,27B,34B,66C 'ibm-api-connect':26B 'let':8A 'onprem':5A,22A 'path':6A,47B,94C 'perform':62B,87C 'remot':51B,79C 'run':11A 'self':31B 'self-host':30B 'travers':7A,48B,95C 'unauthor':63B,88C 'user':10A 'v12':4A,21A 'valid':55B 'vendor':33B 'version':37B 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect V12 OnPrem v12.1.0.0 to v12.1.1.2 is affected. An attacker needs a valid account on the product, then can use path traversal to run code and take administrative actions. 10.0.8.x is listed by NVD only and not confirmed by IBM for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:59:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1990},"products":{"at":"2026-11-07T05:59:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1990},"mitigations":{"at":"2026-11-07T05:59:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1990},"workarounds":{"at":"2026-11-07T05:59:22Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1990}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17147':15A,18A '-2026':14A,17A 'api':2A,19A 'authent':9A 'code':12A 'connect':3A,20A 'cve':13A,16A 'ibm':1A 'let':8A 'onprem':5A,22A 'path':6A 'run':11A 'travers':7A 'user':10A 'v12':4A,21A","search_b":"'10.0.8.0':38B '10.0.8.12':40B '12.1.0.0':42B '12.1.1.2':44B 'account':56B 'action':65B 'administr':64B 'api':24B,28B,35B 'api-gateway':23B 'arbitrari':59B 'attack':52B 'code':60B 'connect':29B,36B 'contain':45B 'execut':58B 'flaw':49B 'gateway':25B 'host':32B 'ibm':27B,34B 'ibm-api-connect':26B 'path':47B 'perform':62B 'remot':51B 'self':31B 'self-host':30B 'travers':48B 'unauthor':63B 'valid':55B 'vendor':33B 'version':37B","search_c":"'10.0.8.0':69C '10.0.8.12':71C '12.1.0.0':73C '12.1.1.2':75C 'action':90C 'administr':89C 'allow':77C 'api':67C 'arbitrari':84C 'attack':81C 'authent':80C 'code':85C 'connect':68C 'could':76C 'due':91C 'execut':83C 'ibm':66C 'path':94C 'perform':87C 'remot':79C 'travers':95C 'unauthor':88C 'vulner':96C","first_public_at":"2026-11-07T05:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17147","severity":null,"published_at":"2026-11-07T05:18:28+00:00","modified_at":"2026-11-07T05:18:28+00:00","first_seen_at":"2026-11-07T05:45:59+00:00","fetched_at":"2026-11-07T05:45:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17147:1990","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:59:22+00:00","modified_at":"2026-11-07T05:59:22+00:00","first_seen_at":"2026-11-07T05:59:22+00:00","fetched_at":"2026-11-07T05:59:22+00:00","note":"IBM bulletin (-39, 2026-11-05) lists CVE-2026-17147 (CWE-22, CVSS 9.9) under API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fix v12.1.1.3, no workarounds. The 10.0.8.0-10.0.8.12 range from NVD is not in this bulletin; the 10.0.8.13 bulletin (-38) does not list this CVE, so 10.0.8 is unconfirmed. No exploitation or PoC found; not searched on X.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}