{"id":"CVE-2026-17340","kind":"vulnerability","aliases":["CVE-2026-17340"],"related":[],"title":"IBM API Connect: path traversal lets remote attackers run arbitrary code","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal flaw that lets a remote attacker escape intended file locations. The flaw can lead to arbitrary code execution on the affected server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","on-prem","path-traversal","unauthenticated","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check your API Connect V12 OnPrem version; versions v12.1.0.0 through v12.1.1.2 are affected, v12.1.1.3 is fixed.\n- The flaw needs no authentication or user interaction (CVSS AV:N/PR:N/UI:N), so any instance reachable from an untrusted network is exposed.","fix":"Upgrade IBM API Connect to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds or mitigations.","status":"open","published_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:19+00:00","updated_at":"2026-11-07T05:54:02+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:48:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: path traversal lets remote attackers run arbitrary code","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal flaw that lets a remote attacker escape intended file locations. The flaw can lead to arbitrary code execution on the affected server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the API Connect server","analyst_note":"Find IBM's security bulletin for CVE-2026-17340 to confirm the fixed version, required setup and whether authentication is needed.","how_to_check":"- Check the installed API Connect version against the affected range `12.1.0.0` through `12.1.1.2`\n- Confirm whether the API Connect deployment is reachable from the internet or an untrusted network","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are exposed. The sources do not say whether authentication or a non-default configuration is required, so treat any reachable instance as potentially exposed until IBM's advisory is checked.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000686,"input_tokens":4194,"output_tokens":534,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17340 to confirm the fixed version, required setup and whether authentication is needed.","search":"'-17340':14A,17A '-2026':13A,16A '12.1.0.0':41B,73C '12.1.1.2':43B,75C 'affect':68B 'allow':77C 'api':2A,18A,23B,27B,38B,71C 'api-gateway':22B 'arbitrari':10A,63B,83C 'attack':8A,53B,80C 'code':11A,64B,84C 'connect':3A,19A,28B,39B,72C 'contain':44B 'could':76C 'cve':12A,15A 'due':85C 'escap':54B 'execut':65B,82C 'file':56B 'flaw':48B,59B 'gateway':24B 'ibm':1A,26B,37B,70C 'ibm-api-connect':25B 'intend':55B 'lead':61B 'let':6A,50B 'locat':57B 'on-prem':29B 'onprem':21A 'path':4A,33B,46B,88C 'path-travers':32B 'prem':31B 'remot':7A,52B,79C 'run':9A 'server':69B 'travers':5A,34B,47B,89C 'unauthent':35B 'v12':20A 'vendor':36B 'version':40B 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM API Connect V12 OnPrem, versions v12.1.0.0 through v12.1.1.2. IBM rates it 9.8: a remote attacker needs no login and no user interaction, and a path traversal can lead to arbitrary code execution. Other API Connect lines (e.g. 10.0.8.x) are covered by separate IBM bulletins and are not listed for this CVE; anyone not running API Connect V12 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974},"products":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974},"mitigations":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974},"workarounds":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974},"how_to_check":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974},"who_affected":{"at":"2026-11-07T05:54:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1974}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","onprem","pathtraversal","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-17340':14A,17A '-2026':13A,16A 'api':2A,18A 'arbitrari':10A 'attack':8A 'code':11A 'connect':3A,19A 'cve':12A,15A 'ibm':1A 'let':6A 'onprem':21A 'path':4A 'remot':7A 'run':9A 'travers':5A 'v12':20A","search_b":"'12.1.0.0':41B '12.1.1.2':43B 'affect':68B 'api':23B,27B,38B 'api-gateway':22B 'arbitrari':63B 'attack':53B 'code':64B 'connect':28B,39B 'contain':44B 'escap':54B 'execut':65B 'file':56B 'flaw':48B,59B 'gateway':24B 'ibm':26B,37B 'ibm-api-connect':25B 'intend':55B 'lead':61B 'let':50B 'locat':57B 'on-prem':29B 'path':33B,46B 'path-travers':32B 'prem':31B 'remot':52B 'server':69B 'travers':34B,47B 'unauthent':35B 'vendor':36B 'version':40B","search_c":"'12.1.0.0':73C '12.1.1.2':75C 'allow':77C 'api':71C 'arbitrari':83C 'attack':80C 'code':84C 'connect':72C 'could':76C 'due':85C 'execut':82C 'ibm':70C 'path':88C 'remot':79C 'travers':89C 'vulner':90C","first_public_at":"2026-11-07T05:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17340","severity":null,"published_at":"2026-11-07T05:18:45+00:00","modified_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17340:1974","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:54:02+00:00","modified_at":"2026-11-07T05:54:02+00:00","first_seen_at":"2026-11-07T05:54:02+00:00","fetched_at":"2026-11-07T05:54:02+00:00","note":"Read IBM bulletin (api-connect-39): CVE-2026-17340 CWE-22, 9.8, AV:N/PR:N (no auth); affected API Connect V12 OnPrem v12.1.0.0-v12.1.1.2; fixed v12.1.1.3; workarounds none. No exploitation/PoC seen.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}