CVE-2026-17147

Summary

A path traversal vulnerability in IBM API Connect allows authenticated low-privilege users to escape directory restrictions and access or modify files outside intended boundaries, potentially leading to remote code execution and unauthorized administrative actions.

Exploitability

Exploitation requires valid authentication with low privileges and knowledge of the vulnerable endpoint path structure; no public exploit is available yet.

Blast radius

Successful exploitation could grant attackers full administrative control over API Connect management functions, compromise sensitive configuration or credential data, and enable persistent backdoor deployment across the infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.