{"id":"CVE-2026-17402","kind":"vulnerability","aliases":["CVE-2026-17402"],"related":[],"title":"IBM API Connect: authenticated OS command injection lets attackers run host commands","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize user input passed to the operating system. A remote attacker with a valid account can run arbitrary commands on the underlying host.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect","fixed":["10.0.8.13"],"affected":">= 10.0.8.0, <= 10.0.8.12","ecosystem":"vendor"},{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["api-gateway","auth-required","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"Check your API Connect version. Exposed if you run 10.0.8.0 through 10.0.8.12, or V12 OnPrem 12.1.0.0 through 12.1.1.2. Fixed in 10.0.8.13 and 12.1.1.3. IBM lists no workarounds.","fix":"Upgrade to 10.0.8.13 (10.0.8.x line) or v12.1.1.3 (V12 OnPrem). IBM lists no workarounds.","status":"open","published_at":"2026-11-07T05:18:56+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","triaged_at":"2026-11-07T05:48:00+00:00","updated_at":"2026-11-07T05:48:47+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-11-07T05:48:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM API Connect: authenticated OS command injection lets attackers run host commands","impact":"high","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 do not neutralize user input passed to the operating system. A remote attacker with a valid account can run arbitrary commands on the underlying host.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on the underlying host","analyst_note":"Check IBM's security bulletin for CVE-2026-17402 for the fixed versions and the vulnerable input path; the NVD entry does not state a fix.","how_to_check":"- Check the installed API Connect version against the affected ranges: `10.0.8.0` through `10.0.8.12` and `12.1.0.0` through `12.1.1.2`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM API Connect in the affected version ranges are exposed, and the risk is highest where the management or API interfaces are reachable from the network. The sources do not say which feature or input path is vulnerable, so teams cannot yet narrow the exposure beyond the version range. Teams on other versions are not in the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4265,"output_tokens":583,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check IBM's security bulletin for CVE-2026-17402 for the fixed versions and the vulnerable input path; the NVD entry does not state a fix.","search":"'-17402':15A,18A '-2026':14A,17A '10.0.8.0':43B,78C '10.0.8.12':45B,80C '12.1.0.0':47B,82C '12.1.1.2':49B,84C 'account':66B 'allow':86C,118C 'api':2A,19A,21A,26B,33B,40B,76C 'api-gateway':25B 'arbitrari':69B,93C 'attack':9A,62B,90C 'auth':29B 'auth-requir':28B 'authent':4A,89C 'command':6A,12A,70B,94C,98C,119C 'connect':3A,20A,22A,34B,41B,77C 'could':85C,117C 'cve':13A,16A 'due':95C 'execut':92C 'gateway':27B 'host':11A,37B,74B,125C 'ibm':1A,32B,39B,75C 'ibm-api-connect':31B 'inject':7A,99C 'input':54B,103C 'let':8A 'neutral':52B,107C 'onprem':24A 'oper':58B,114C 'os':5A,97C 'pass':55B,111C 'proper':106C 'remot':61B,88C 'requir':30B 'run':10A,68B,121C 'self':36B 'self-host':35B 'suppli':102C 'system':59B,115C 'under':73B,124C 'user':53B,101C 'user-suppli':100C 'v12':23A 'valid':65B 'vendor':38B 'version':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or V12 OnPrem 12.1.0.0-12.1.1.2 are exposed to any user with a valid account (low privilege), who can run OS commands on the host. IBM does not say which input or feature is vulnerable, so the version is the only check. Teams already on 10.0.8.13 or 12.1.1.3 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-07T05:48:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1957},"products":{"at":"2026-11-07T05:48:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1957},"workarounds":{"at":"2026-11-07T05:48:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1957},"how_to_check":{"at":"2026-11-07T05:48:47Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","run_id":1957}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnect","apiconnectv12onprem","connect","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["apigateway","authrequired","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-17402':15A,18A '-2026':14A,17A 'api':2A,19A,21A 'attack':9A 'authent':4A 'command':6A,12A 'connect':3A,20A,22A 'cve':13A,16A 'host':11A 'ibm':1A 'inject':7A 'let':8A 'onprem':24A 'os':5A 'run':10A 'v12':23A","search_b":"'10.0.8.0':43B '10.0.8.12':45B '12.1.0.0':47B '12.1.1.2':49B 'account':66B 'api':26B,33B,40B 'api-gateway':25B 'arbitrari':69B 'attack':62B 'auth':29B 'auth-requir':28B 'command':70B 'connect':34B,41B 'gateway':27B 'host':37B,74B 'ibm':32B,39B 'ibm-api-connect':31B 'input':54B 'neutral':52B 'oper':58B 'pass':55B 'remot':61B 'requir':30B 'run':68B 'self':36B 'self-host':35B 'system':59B 'under':73B 'user':53B 'valid':65B 'vendor':38B 'version':42B","search_c":"'10.0.8.0':78C '10.0.8.12':80C '12.1.0.0':82C '12.1.1.2':84C 'allow':86C,118C 'api':76C 'arbitrari':93C 'attack':90C 'authent':89C 'command':94C,98C,119C 'connect':77C 'could':85C,117C 'due':95C 'execut':92C 'host':125C 'ibm':75C 'inject':99C 'input':103C 'neutral':107C 'oper':114C 'os':97C 'pass':111C 'proper':106C 'remot':88C 'run':121C 'suppli':102C 'system':115C 'under':124C 'user':101C 'user-suppli':100C","first_public_at":"2026-11-07T05:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17402","severity":null,"published_at":"2026-11-07T05:18:56+00:00","modified_at":"2026-11-07T05:18:56+00:00","first_seen_at":"2026-11-07T05:46:07+00:00","fetched_at":"2026-11-07T05:46:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-17402:1957","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","severity":null,"published_at":"2026-11-07T05:48:47+00:00","modified_at":"2026-11-07T05:48:47+00:00","first_seen_at":"2026-11-07T05:48:47+00:00","fetched_at":"2026-11-07T05:48:47+00:00","note":"Read both IBM bulletins (-41 for 10.0.8.x, -39 for V12 OnPrem); both list CVE-2026-17402 (CWE-78, 9.9), fix 10.0.8.13 / v12.1.1.3, workarounds None. No exploitation or PoC found; input path not stated by IBM.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39"]}],"documents":[{"id":93150,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-41","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (10.0.8.13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":93149,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-39","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}