---
id: "CVE-2026-17399"
page: "https://infrastack.ai/live/CVE-2026-17399"
kind: "vulnerability"
aliases: ["CVE-2026-17399"]
title: "IBM API Connect: uploaded content flaw lets an authenticated user run code"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "IBM API Connect", "fixed": ["10.0.8.13"], "affected": ">= 10.0.8.0, <= 10.0.8.12", "ecosystem": "vendor"}, {"name": "IBM API Connect V12 OnPrem", "fixed": ["12.1.1.3"], "affected": ">= 12.1.0.0, <= 12.1.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api-gateway", "auth-required", "ibm-api-connect", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "unaffected-version"]
published_at: "2026-11-07T05:18:55+00:00"
first_seen_at: "2026-11-07T05:46:07+00:00"
updated_at: "2026-11-07T05:48:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17399", "first_seen_at": "2026-11-07T05:46:07+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "first_seen_at": "2026-11-07T05:48:51+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39", "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41"]}]
exploit_sources: []
---

# IBM API Connect: uploaded content flaw lets an authenticated user run code

Link for people: https://infrastack.ai/live/CVE-2026-17399 (this .md is for agents)

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not sufficiently check uploaded content before processing it. A remote attacker with a valid account can make code run on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM API Connect affected >= 10.0.8.0, <= 10.0.8.12 fixed 10.0.8.13
- vendor:IBM API Connect V12 OnPrem affected >= 12.1.0.0, <= 12.1.1.2 fixed 12.1.1.3

## How to check

Check your installed API Connect version. Vulnerable: V10.0.8.0 through 10.0.8.12, and V12 OnPrem v12.1.0.0 through v12.1.1.2. Fixed: 10.0.8.13 and v12.1.1.3. IBM does not say which upload feature is affected, so check the version, not a feature.

## Fix

Upgrade IBM API Connect V10.0.8 to 10.0.8.13, or V12 OnPrem to v12.1.1.3 (Fix Central; V12 link https://www.ibm.com/support/pages/node/7290205). IBM lists no workaround.

## Timeline

- 2026-11-07T05:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-17399
- 2026-11-07T05:48:51+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39 — Read both IBM bulletins (V10.0.8 fixed 10.0.8.13; V12 fixed 12.1.1.3), both list CVE-2026-17399 CVSS 9.9 CWE-434; workarounds None. No exploitation or PoC checked beyond bulletin. Vulnerable upload feature not named by IBM. A fetch summarizer wrongly claimed the CVE absent from 10.0.8 bulletin; raw page text lists it.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39
- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41

## From the sources

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_