{"id":"CVE-2026-17239","kind":"vulnerability","aliases":["CVE-2026-17239"],"related":[],"title":"IBM API Connect: path traversal lets an authenticated user run code remotely","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can use it to execute arbitrary code.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["v12.1.1.3"],"affected":">= v12.1.0.0, <= v12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","authenticated","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check installed API Connect V12 on-prem version; v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 is fixed.","fix":"Upgrade to IBM API Connect v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","triaged_at":"2026-11-07T05:48:08+00:00","updated_at":"2026-11-07T05:58:28+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: path traversal lets an authenticated user run code remotely","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal flaw. A remote attacker with a valid account can use it to execute arbitrary code.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the API Connect server","analyst_note":"Find IBM's security bulletin for CVE-2026-17239 to confirm the fixed version, affected components and any workaround.","how_to_check":"- Check the installed API Connect version against the affected range 12.1.0.0 through 12.1.1.2.\n- unknown for other checks: the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can authenticate to the platform. The sources do not describe specific configurations, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000661,"input_tokens":4199,"output_tokens":483,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17239 to confirm the fixed version, affected components and any workaround.","search":"'-17239':15A,18A '-2026':14A,17A '12.1.0.0':39B,64C '12.1.1.2':41B,66C 'account':53B 'allow':68C 'api':2A,19A,24B,29B,36B,62C 'api-gateway':23B 'arbitrari':59B,75C 'attack':49B,72C 'authent':8A,26B,71C 'code':11A,60B,76C 'connect':3A,20A,30B,37B,63C 'contain':42B 'could':67C 'cve':13A,16A 'due':77C 'execut':58B,74C 'flaw':46B 'gateway':25B 'host':33B 'ibm':1A,28B,35B,61C 'ibm-api-connect':27B 'let':6A 'onprem':22A 'path':4A,44B,80C 'remot':12A,48B,70C 'run':10A 'self':32B 'self-host':31B 'travers':5A,45B,81C 'use':55B 'user':9A 'v12':21A 'valid':52B 'vendor':34B 'version':38B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM API Connect 12.1.0.0 through 12.1.1.2 where users can authenticate to the platform. The sources do not describe specific configurations, so the exact exposure is unknown.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:58:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1987},"products":{"at":"2026-11-07T05:58:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1987},"how_to_check":{"at":"2026-11-07T05:58:28Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1987}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authenticated","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17239':15A,18A '-2026':14A,17A 'api':2A,19A 'authent':8A 'code':11A 'connect':3A,20A 'cve':13A,16A 'ibm':1A 'let':6A 'onprem':22A 'path':4A 'remot':12A 'run':10A 'travers':5A 'user':9A 'v12':21A","search_b":"'12.1.0.0':39B '12.1.1.2':41B 'account':53B 'api':24B,29B,36B 'api-gateway':23B 'arbitrari':59B 'attack':49B 'authent':26B 'code':60B 'connect':30B,37B 'contain':42B 'execut':58B 'flaw':46B 'gateway':25B 'host':33B 'ibm':28B,35B 'ibm-api-connect':27B 'path':44B 'remot':48B 'self':32B 'self-host':31B 'travers':45B 'use':55B 'valid':52B 'vendor':34B 'version':38B","search_c":"'12.1.0.0':64C '12.1.1.2':66C 'allow':68C 'api':62C 'arbitrari':75C 'attack':72C 'authent':71C 'code':76C 'connect':63C 'could':67C 'due':77C 'execut':74C 'ibm':61C 'path':80C 'remot':70C 'travers':81C 'vulner':82C","first_public_at":"2026-11-07T05:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17239","severity":null,"published_at":"2026-11-07T05:18:32+00:00","modified_at":"2026-11-07T05:18:32+00:00","first_seen_at":"2026-11-07T05:46:00+00:00","fetched_at":"2026-11-07T05:46:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17239:1987","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:58:28+00:00","modified_at":"2026-11-07T05:58:28+00:00","first_seen_at":"2026-11-07T05:58:28+00:00","fetched_at":"2026-11-07T05:58:28+00:00","note":"Read IBM bulletin (-39): CVE-2026-17239 CWE-22, CVSS 9.9, API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed in v12.1.1.3, IBM lists no workarounds. Not in KEV per NVD mirror; exploitation/PoC and social not checked (B tier).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}