---
id: "CVE-2026-17342"
page: "https://infrastack.ai/live/CVE-2026-17342"
kind: "vulnerability"
aliases: ["CVE-2026-17342"]
title: "IBM API Connect: authenticated remote code execution through unsafe code generation"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "api-connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "api-connect-v12-onprem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-connect", "authenticated", "ibm", "self-hosted", "vendor"]
not_affected_if: ["unaffected-version"]
published_at: "2026-11-07T05:18:45+00:00"
first_seen_at: "2026-11-07T05:46:04+00:00"
updated_at: "2026-11-07T05:54:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17342", "first_seen_at": "2026-11-07T05:46:04+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "first_seen_at": "2026-11-07T05:54:11+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}]
exploit_sources: []
---

# IBM API Connect: authenticated remote code execution through unsafe code generation

Link for people: https://infrastack.ai/live/CVE-2026-17342 (this .md is for agents)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a remote attacker with valid credentials execute arbitrary code, because the product improperly controls how code is generated. An attacker who can log in gets code execution on the server running the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:api-connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:api-connect-v12-onprem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your API Connect version. Exposed if it is 10.0.8.0 through 10.0.8.12, or V12 on-prem 12.1.0.0 through 12.1.1.2. Any user who can log in can trigger it, so also review who has accounts.

## Fix

Upgrade to API Connect 10.0.8.13 (V10) or 12.1.1.3 (V12 OnPrem), via IBM Fix Central. IBM lists no workarounds.

## Timeline

- 2026-11-07T05:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17342
- 2026-11-07T05:54:11+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41 — Read both IBM bulletins (Nov 5 2026): V10 bulletin lists 10.0.8.0-10.0.8.12 fixed in 10.0.8.13; V12 OnPrem bulletin lists 12.1.0.0-12.1.1.2 fixed in 12.1.1.3. IBM states no workarounds. Exploitation/PoC and social posts not searched; none seen in sources.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_