CVE-2026-17117

Summary

IBM API Connect contains a flaw in how it handles object attribute modification, allowing an authenticated low-privilege user to set system-controlled fields that should be immutable, potentially leading to arbitrary code execution.

Exploitability

Exploitation requires valid authentication and low privileges; the attack is network-based and does not require user interaction.

Blast radius

Successful exploitation could allow full compromise of the API Connect management plane, including data exfiltration, system modification, and service disruption across connected APIs.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.