API CONNECT · CVE-2026-17408 · Vendor
FIX → 10.0.8.13 · 12.1.1.3 ✓ verified
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 fails to neutralize special characters in OS commands. A remote attacker can execute arbitrary code on the affected server.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running self-managed IBM API Connect 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2. IBM's CVSS 9.8 vector (network, low complexity, no privileges, no user interaction) means an unauthenticated remote attacker who can reach the instance could run OS commands (CWE-78). Teams on 10.0.8.13, 12.1.1.3 or later can skip it.
Not affected if unaffected-version, unknown
Who cares api-gateway, ibm-api-connect, self-hosted
10.0.8.0 through 10.0.8.12, or 12.1.0.0 through 12.1.1.210.0.8.13 and 12.1.1.3 or laterIBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 10.0.8.13 · 12.1.1.3
10.0.8.13 (from 10.0.8.0-10.0.8.12) or 12.1.1.3 (from 12.1.0.0-12.1.1.2), from IBM Fix Central