CVE-2026-16880

Summary

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a path traversal vulnerability (CWE-22) that allows an authenticated remote attacker to access sensitive files outside intended directories. This flaw enables unauthorized disclosure of internal configuration or credential data.

Exploitability

Exploitation requires valid authentication credentials and knowledge of vulnerable endpoints, but the low attack complexity and lack of user interaction make it feasible for a compromised or insider account.

Blast radius

Successful exploitation could expose sensitive system files such as configuration files, API keys, or private certificates, potentially enabling further compromise of the API management infrastructure or downstream services.

Detection

Defenders should monitor web access logs for requests containing encoded or unencoded path traversal sequences (e.g., '../', '%2e%2e/', '..%2f') in URI paths, especially when combined with authenticated sessions and unusual file extensions or directory patterns like /etc/, /opt/, or /usr/. No reliable host-based artefacts are described.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.