{"id":"CVE-2026-17399","kind":"vulnerability","aliases":["CVE-2026-17399"],"related":[],"title":"IBM API Connect: uploaded content flaw lets an authenticated user run code","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently check uploaded content before processing it. A remote attacker with a valid account can make code run on the server.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"IBM API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["auth-required","unaffected-version"],"how_to_check":"Check your installed API Connect version. Vulnerable: V10.0.8.0 through 10.0.8.12, and V12 OnPrem v12.1.0.0 through v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. IBM does not say which upload feature is affected, so check the version, not a feature.","fix":"Upgrade IBM API Connect V10.0.8 to 10.0.8.13, or V12 OnPrem to v12.1.1.3 (Fix Central; V12 link https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.","status":"open","published_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:00+00:00","updated_at":"2026-11-07T05:48:51+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-07T05:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: uploaded content flaw lets an authenticated user run code","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently check uploaded content before processing it. A remote attacker with a valid account can make code run on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","self-hosted","api-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the API Connect server","analyst_note":"Find the IBM security bulletin for CVE-2026-17399 to confirm the fixed versions and the vulnerable upload feature.","how_to_check":"- Check the installed API Connect version against the affected ranges: 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges, where users can upload content to the product. The sources do not say which upload features are involved or whether non-default configuration is required. Systems outside those version ranges are not listed as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000692,"input_tokens":4266,"output_tokens":530,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-17399 to confirm the fixed versions and the vulnerable upload feature.","search":"'-17399':15A,18A '-2026':14A,17A '10.0.8.0':45B,78C '10.0.8.12':47B,80C '12.1.0.0':49B,82C '12.1.1.2':51B,84C 'account':67B 'allow':86C,117C 'api':2A,20A,23A,28B,35B,42B,76C 'api-gateway':27B 'arbitrari':93C 'attack':63B,90C 'auth':31B 'auth-requir':30B 'authent':9A,89C 'check':55B,110C 'code':12A,70B,94C,118C 'connect':3A,21A,24A,36B,43B,77C 'content':5A,57B,101C,102C 'could':85C,116C 'cve':13A,16A 'due':95C 'execut':92C 'flaw':6A 'gateway':29B 'host':39B 'ibm':1A,19A,22A,34B,41B,75C 'ibm-api-connect':33B 'insuffici':97C 'let':7A 'make':69B 'onprem':26A 'process':59B,114C 'product':106C 'remot':62B,88C 'requir':32B 'run':11A,71B,120C 'self':38B 'self-host':37B 'server':74B,123C 'suffici':54B,109C 'upload':4A,56B,100C,103C 'user':10A 'v12':25A 'valid':66B,98C 'vendor':40B 'version':44B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM API Connect (V10.0.8.0-10.0.8.12 and V12 OnPrem 12.1.0.0-12.1.1.2) is exposed to anyone who holds a valid account (CVSS 9.9, CWE-434 unrestricted upload): content they upload is not sufficiently checked before processing, so code can run on the server. IBM does not name the upload feature. Teams not running these versions can skip it; IBM does not rule out other deployment types in the bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958},"products":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958},"mitigations":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958},"workarounds":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958},"how_to_check":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958},"who_affected":{"at":"2026-11-07T05:48:51Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","run_id":1958}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","ibmapiconnect","ibmapiconnectv12onprem"],"ptokens":["api","connect","ibm","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17399':15A,18A '-2026':14A,17A 'api':2A,20A,23A 'authent':9A 'code':12A 'connect':3A,21A,24A 'content':5A 'cve':13A,16A 'flaw':6A 'ibm':1A,19A,22A 'let':7A 'onprem':26A 'run':11A 'upload':4A 'user':10A 'v12':25A","search_b":"'10.0.8.0':45B '10.0.8.12':47B '12.1.0.0':49B '12.1.1.2':51B 'account':67B 'api':28B,35B,42B 'api-gateway':27B 'attack':63B 'auth':31B 'auth-requir':30B 'check':55B 'code':70B 'connect':36B,43B 'content':57B 'gateway':29B 'host':39B 'ibm':34B,41B 'ibm-api-connect':33B 'make':69B 'process':59B 'remot':62B 'requir':32B 'run':71B 'self':38B 'self-host':37B 'server':74B 'suffici':54B 'upload':56B 'valid':66B 'vendor':40B 'version':44B","search_c":"'10.0.8.0':78C '10.0.8.12':80C '12.1.0.0':82C '12.1.1.2':84C 'allow':86C,117C 'api':76C 'arbitrari':93C 'attack':90C 'authent':89C 'check':110C 'code':94C,118C 'connect':77C 'content':101C,102C 'could':85C,116C 'due':95C 'execut':92C 'ibm':75C 'insuffici':97C 'process':114C 'product':106C 'remot':88C 'run':120C 'server':123C 'suffici':109C 'upload':100C,103C 'valid':98C","first_public_at":"2026-11-07T05:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17399","severity":null,"published_at":"2026-11-07T05:18:55+00:00","modified_at":"2026-11-07T05:18:55+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17399:1958","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","severity":null,"published_at":"2026-11-07T05:48:51+00:00","modified_at":"2026-11-07T05:48:51+00:00","first_seen_at":"2026-11-07T05:48:51+00:00","fetched_at":"2026-11-07T05:48:51+00:00","note":"Read both IBM bulletins (V10.0.8 fixed 10.0.8.13; V12 fixed 12.1.1.3), both list CVE-2026-17399 CVSS 9.9 CWE-434; workarounds None. No exploitation or PoC checked beyond bulletin. Vulnerable upload feature not named by IBM. A fetch summarizer wrongly claimed the CVE absent from 10.0.8 bulletin; raw page text lists it.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}],"documents":[{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}