{"id":"CVE-2026-17359","kind":"vulnerability","aliases":["CVE-2026-17359"],"related":[],"title":"IBM API Connect: authenticated remote code execution via generated code","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a remote authenticated attacker supply a value that changes code the product generates. That lets the attacker execute arbitrary code on the server.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":"10.0.8.0 - 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":"12.1.0.0 - 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","ibm-api-connect","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"Check your API Connect version. Affected: V10.0.8.0 - V10.0.8.12 and V12 OnPrem v12.1.0.0 - v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3.","fix":"Upgrade IBM API Connect 10.0.8.x to 10.0.8.13, or 12.1.x on-prem to v12.1.1.3 (Fix Central; IBM lists no workaround).","status":"open","published_at":"2026-11-07T05:18:48+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","triaged_at":"2026-11-07T05:48:04+00:00","updated_at":"2026-11-07T05:53:02+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-07T05:48:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated remote code execution via generated code","impact":"high","summary":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 let a remote authenticated attacker supply a value that changes code the product generates. That lets the attacker execute arbitrary code on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the API Connect server.","analyst_note":"Find IBM's security bulletin for CVE-2026-17359 to confirm the fixed versions and any required configuration; the NVD entry gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges. Exploitation needs an authenticated account that can reach the product's input path. Teams on other versions or without API Connect can skip it. The sources do not say which features generate the code or which account role is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000703,"input_tokens":4253,"output_tokens":555,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-17359 to confirm the fixed versions and any required configuration; the NVD entry gives no fix.","search":"'-17359':13A,16A '-2026':12A,15A '10.0.8.0':39B,73C '10.0.8.12':41B,75C '12.1.0.0':43B,77C '12.1.1.2':45B,79C 'allow':81C 'api':2A,18A,21A,26B,30B,37B,71C 'api-gateway':25B 'arbitrari':65B,88C 'attack':50B,63B,85C 'authent':4A,49B,84C 'chang':55B 'code':6A,10A,56B,66B,89C,97C,105C,114C 'connect':3A,19A,22A,31B,38B,72C 'control':93C 'could':80C,111C 'cve':11A,14A 'due':90C 'execut':7A,64B,87C,115C 'gateway':27B 'generat':9A,59B,95C,109C 'host':35B 'ibm':1A,17A,20A,29B,36B,70C 'ibm-api-connect':28B 'improp':92C 'influenc':104C 'infrastructur':32B 'lead':112C 'let':46B,61B 'onprem':24A 'product':58B,108C 'remot':5A,48B,83C 'self':34B 'self-host':33B 'server':69B 'suppli':51B,101C 'user':100C 'user-suppli':99C 'v12':23A 'valu':53B,102C 'via':8A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0 through 10.0.8.12 or 12.1.0.0 through 12.1.1.2 (IBM lists V12 OnPrem). Any authenticated user with low privileges can supply a value that changes code the product generates, which leads to code execution on the server. Teams on the fixed versions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:53:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1969},"products":{"at":"2026-11-07T05:53:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1969},"how_to_check":{"at":"2026-11-07T05:53:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1969},"who_affected":{"at":"2026-11-07T05:53:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1969}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","critical","ibmapiconnect","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-17359':13A,16A '-2026':12A,15A 'api':2A,18A,21A 'authent':4A 'code':6A,10A 'connect':3A,19A,22A 'cve':11A,14A 'execut':7A 'generat':9A 'ibm':1A,17A,20A 'onprem':24A 'remot':5A 'v12':23A 'via':8A","search_b":"'10.0.8.0':39B '10.0.8.12':41B '12.1.0.0':43B '12.1.1.2':45B 'api':26B,30B,37B 'api-gateway':25B 'arbitrari':65B 'attack':50B,63B 'authent':49B 'chang':55B 'code':56B,66B 'connect':31B,38B 'execut':64B 'gateway':27B 'generat':59B 'host':35B 'ibm':29B,36B 'ibm-api-connect':28B 'infrastructur':32B 'let':46B,61B 'product':58B 'remot':48B 'self':34B 'self-host':33B 'server':69B 'suppli':51B 'valu':53B","search_c":"'10.0.8.0':73C '10.0.8.12':75C '12.1.0.0':77C '12.1.1.2':79C 'allow':81C 'api':71C 'arbitrari':88C 'attack':85C 'authent':84C 'code':89C,97C,105C,114C 'connect':72C 'control':93C 'could':80C,111C 'due':90C 'execut':87C,115C 'generat':95C,109C 'ibm':70C 'improp':92C 'influenc':104C 'lead':112C 'product':108C 'remot':83C 'suppli':101C 'user':100C 'user-suppli':99C 'valu':102C","first_public_at":"2026-11-07T05:18:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17359","severity":null,"published_at":"2026-11-07T05:18:48+00:00","modified_at":"2026-11-07T05:18:48+00:00","first_seen_at":"2026-11-07T05:46:05+00:00","fetched_at":"2026-11-07T05:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17359:1969","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:53:02+00:00","modified_at":"2026-11-07T05:53:02+00:00","first_seen_at":"2026-11-07T05:53:02+00:00","fetched_at":"2026-11-07T05:53:02+00:00","note":"IBM bulletins (10.0.8.13 and v12.1.1.3) list CVE-2026-17359, CWE-94, CVSS 9.9, no workarounds. No exploitation or PoC found in Feedly; X not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}