{"id":"CVE-2026-17342","kind":"vulnerability","aliases":["CVE-2026-17342"],"related":[],"title":"IBM API Connect: authenticated remote code execution through unsafe code generation","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a remote attacker with valid credentials execute arbitrary code, because the product improperly controls how code is generated. An attacker who can log in gets code execution on the server running the product.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"api-connect-v12-onprem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-connect","authenticated","ibm","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12, or V12 on-prem 12.1.0.0 through 12.1.1.2. Any user who can log in can trigger it, so also review who has accounts.","fix":"Upgrade to API Connect 10.0.8.13 (V10) or 12.1.1.3 (V12 OnPrem), via IBM Fix Central. IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:45+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","triaged_at":"2026-11-07T05:48:04+00:00","updated_at":"2026-11-07T05:54:11+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM API Connect: authenticated remote code execution through unsafe code generation","impact":"high","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a remote attacker with valid credentials execute arbitrary code, because the product improperly controls how code is generated. An attacker who can log in gets code execution on the server running the product.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm","api-connect","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the API Connect server after authenticated login","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and the exposed component; the NVD entry alone gives no fix or check.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- Confirm whether your API Connect deployment is reachable from networks where users can authenticate remotely.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges, where remote users can authenticate to the management or gateway interfaces. The sources do not state the exact exposed component or default configuration. Teams on versions outside the listed ranges are not affected by this record.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4227,"output_tokens":575,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed versions and the exposed component; the NVD entry alone gives no fix or check.","search":"'-17342':14A,17A '-2026':13A,16A '10.0.8.0':38B,82C '10.0.8.12':40B,84C '12.1.0.0':42B,86C '12.1.1.2':44B,88C 'allow':90C 'api':2A,19A,22A,27B,36B,80C 'api-connect':18A,26B 'api-connect-v12-onprem':21A 'arbitrari':53B,97C 'attack':48B,65B,94C 'authent':4A,29B,93C 'code':6A,10A,54B,61B,71B,98C,106C 'connect':3A,20A,23A,28B,37B,81C 'control':59B,102C 'could':89C 'credenti':51B 'cve':12A,15A 'due':99C 'execut':7A,52B,72B,96C 'generat':11A,63B,104C 'get':70B 'host':33B 'ibm':1A,30B,35B,79C 'improp':58B,101C 'let':45B 'log':68B 'onprem':25A 'product':57B,78B 'remot':5A,47B,92C 'run':76B 'self':32B 'self-host':31B 'server':75B 'unsaf':9A 'v12':24A 'valid':50B 'vendor':34B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted/on-prem IBM API Connect deployments on 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. An attacker needs valid credentials (a low-privilege account is enough per the CVSS vector), then can run code on the server through user input that influences generated code. Teams not running API Connect can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:54:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1973},"products":{"at":"2026-11-07T05:54:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1973},"workarounds":{"at":"2026-11-07T05:54:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1973},"how_to_check":{"at":"2026-11-07T05:54:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1973},"who_affected":{"at":"2026-11-07T05:54:11Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1973}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apiconnect","authenticated","critical","ibm","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17342':14A,17A '-2026':13A,16A 'api':2A,19A,22A 'api-connect':18A 'api-connect-v12-onprem':21A 'authent':4A 'code':6A,10A 'connect':3A,20A,23A 'cve':12A,15A 'execut':7A 'generat':11A 'ibm':1A 'onprem':25A 'remot':5A 'unsaf':9A 'v12':24A","search_b":"'10.0.8.0':38B '10.0.8.12':40B '12.1.0.0':42B '12.1.1.2':44B 'api':27B,36B 'api-connect':26B 'arbitrari':53B 'attack':48B,65B 'authent':29B 'code':54B,61B,71B 'connect':28B,37B 'control':59B 'credenti':51B 'execut':52B,72B 'generat':63B 'get':70B 'host':33B 'ibm':30B,35B 'improp':58B 'let':45B 'log':68B 'product':57B,78B 'remot':47B 'run':76B 'self':32B 'self-host':31B 'server':75B 'valid':50B 'vendor':34B","search_c":"'10.0.8.0':82C '10.0.8.12':84C '12.1.0.0':86C '12.1.1.2':88C 'allow':90C 'api':80C 'arbitrari':97C 'attack':94C 'authent':93C 'code':98C,106C 'connect':81C 'control':102C 'could':89C 'due':99C 'execut':96C 'generat':104C 'ibm':79C 'improp':101C 'remot':92C","first_public_at":"2026-11-07T05:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17342","severity":null,"published_at":"2026-11-07T05:18:45+00:00","modified_at":"2026-11-07T05:18:46+00:00","first_seen_at":"2026-11-07T05:46:04+00:00","fetched_at":"2026-11-07T05:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17342:1973","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:54:11+00:00","modified_at":"2026-11-07T05:54:11+00:00","first_seen_at":"2026-11-07T05:54:11+00:00","fetched_at":"2026-11-07T05:54:11+00:00","note":"Read both IBM bulletins (Nov 5 2026): V10 bulletin lists 10.0.8.0-10.0.8.12 fixed in 10.0.8.13; V12 OnPrem bulletin lists 12.1.0.0-12.1.1.2 fixed in 12.1.1.3. IBM states no workarounds. Exploitation/PoC and social posts not searched; none seen in sources.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}