CVE-2026-17150
9.9 CRITICALPublished 2026-11-07 · Updated 2026-11-10
AI risk analysis
- Summary
- IBM API Connect contains an insufficient input validation vulnerability (CWE-184) that allows authenticated attackers to upload malicious custom module content, leading to arbitrary code execution and cross-tenant data access due to lack of proper sandboxing during processing.
- Exploitability
- Requires low-privilege authenticated access; no user interaction or complex conditions needed.
- Blast radius
- Successful exploitation enables full tenant isolation bypass, allowing attackers to compromise other tenants' systems and exfiltrate sensitive cross-tenant data.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 (or later), which contains the vendor-provided fix for this vulnerability.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-184
Vendors
ibm
Products
api connect
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-106556PoC
- HIGHCVE-2026-100559PoC
- CRITICALCVE-2026-10131
- CRITICALCVE-2026-10132
- CRITICALCVE-2026-10133
- CRITICALCVE-2026-10135
- CRITICALCVE-2026-10136
- CRITICALCVE-2026-10137
Related by shared AI tags and CWE weakness class. Browse the full archive.