{"id":"CVE-2026-17354","kind":"vulnerability","aliases":["CVE-2026-17354"],"related":[],"title":"IBM API Connect: authenticated path traversal allows arbitrary file writes","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.","summary":"IBM API Connect V12 OnPrem v12.1.0.0 through v12.1.1.2 has a path traversal flaw (CWE-22) that lets a remote authenticated user write arbitrary files on the server (CVSS 9.9). IBM fixed it in v12.1.1.3 and lists no workarounds. The bulletin does not name the endpoint or describe exploitation.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"api-connect","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check your API Connect V12 OnPrem version; affected if it is between v12.1.0.0 and v12.1.1.2 inclusive. Fixed in v12.1.1.3.","fix":"Upgrade IBM API Connect V12 OnPrem to v12.1.1.3 (Fix Central: https://www.ibm.com/support/pages/node/7290205). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:48:04+00:00","updated_at":"2026-11-07T05:53:08+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated path traversal allows arbitrary file writes","impact":"high","summary":"IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a path traversal flaw that lets a remote authenticated user write files anywhere on the server. An attacker who can log in could plant or overwrite files, which can lead to code execution, though the sources do not describe the exact write path.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker writes arbitrary files on the server","analyst_note":"Find the IBM security bulletin for CVE-2026-17354 to confirm the fixed version, the affected endpoint, and whether a patch exists.","how_to_check":"- Check the installed API Connect version in the product admin console or deployment manifest; the affected range is `12.1.0.0` through `12.1.1.2`.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running IBM API Connect in the 12.1.0.0 to 12.1.1.2 range are exposed, and only to users who hold valid accounts on the platform. Deployments on other versions, or with no authenticated users who could be untrusted, are less exposed. The sources do not say which specific feature or endpoint carries the traversal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4194,"output_tokens":585,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17354 to confirm the fixed version, the affected endpoint, and whether a patch exists.","search":"'-17354':13A,16A '-2026':12A,15A '-22':48B '12.1.0.0':85C '12.1.1.2':87C '9.9':62B 'allow':7A,89C 'api':2A,18A,21B,28B,35B,83C 'api-connect':17A 'api-gateway':20B 'arbitrari':8A,56B,96C 'attack':93C 'auth':24B 'auth-requir':23B 'authent':4A,53B,92C 'bulletin':73B 'connect':3A,19A,29B,36B,84C 'could':88C 'cve':11A,14A 'cvss':61B 'cwe':47B 'describ':80B 'due':99C 'endpoint':78B 'exploit':81B 'file':9A,57B,97C 'fix':64B 'flaw':46B 'gateway':22B 'host':32B 'ibm':1A,27B,34B,63B,82C 'ibm-api-connect':26B 'let':50B 'list':69B 'name':76B 'onprem':38B 'path':5A,44B,101C 'perform':95C 'remot':52B,91C 'requir':25B 'self':31B 'self-host':30B 'server':60B 'travers':6A,45B,102C 'user':54B 'v12':37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':67B 'vendor':33B 'workaround':71B 'write':10A,55B,98C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM API Connect V12 (on-prem) at v12.1.0.0 through v12.1.1.2. Exploitation needs a valid login (low privileges), but the bulletin rates scope as changed with high impact, so any user account on the platform counts. Teams on other API Connect lines or not running V12 on-prem are not listed in this bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:53:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1970},"products":{"at":"2026-11-07T05:53:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1970},"workarounds":{"at":"2026-11-07T05:53:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1970},"how_to_check":{"at":"2026-11-07T05:53:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1970},"who_affected":{"at":"2026-11-07T05:53:08Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1970}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect"],"ptokens":["api","connect"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17354':13A,16A '-2026':12A,15A 'allow':7A 'api':2A,18A 'api-connect':17A 'arbitrari':8A 'authent':4A 'connect':3A,19A 'cve':11A,14A 'file':9A 'ibm':1A 'path':5A 'travers':6A 'write':10A","search_b":"'-22':48B '9.9':62B 'api':21B,28B,35B 'api-gateway':20B 'arbitrari':56B 'auth':24B 'auth-requir':23B 'authent':53B 'bulletin':73B 'connect':29B,36B 'cvss':61B 'cwe':47B 'describ':80B 'endpoint':78B 'exploit':81B 'file':57B 'fix':64B 'flaw':46B 'gateway':22B 'host':32B 'ibm':27B,34B,63B 'ibm-api-connect':26B 'let':50B 'list':69B 'name':76B 'onprem':38B 'path':44B 'remot':52B 'requir':25B 'self':31B 'self-host':30B 'server':60B 'travers':45B 'user':54B 'v12':37B 'v12.1.0.0':39B 'v12.1.1.2':41B 'v12.1.1.3':67B 'vendor':33B 'workaround':71B 'write':55B","search_c":"'12.1.0.0':85C '12.1.1.2':87C 'allow':89C 'api':83C 'arbitrari':96C 'attack':93C 'authent':92C 'connect':84C 'could':88C 'due':99C 'file':97C 'ibm':82C 'path':101C 'perform':95C 'remot':91C 'travers':102C 'write':98C","first_public_at":"2026-11-07T05:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17354","severity":null,"published_at":"2026-11-07T05:18:47+00:00","modified_at":"2026-11-07T05:18:47+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17354:1970","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:53:08+00:00","modified_at":"2026-11-07T05:53:08+00:00","first_seen_at":"2026-11-07T05:53:08+00:00","fetched_at":"2026-11-07T05:53:08+00:00","note":"Read IBM bulletin (-39, 2026-11-05): CVE-2026-17354 path traversal, arbitrary file write, CVSS 9.9, affects API Connect V12 OnPrem v12.1.0.0-v12.1.1.2, fixed in v12.1.1.3, no workarounds. Bulletin gives no endpoint or exploitation info; exploited status unchanged. Part of a large multi-CVE bulletin.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}