CVE-2026-17239

Summary

A path traversal vulnerability in IBM API Connect 12.1.0.0 through 12.1.1.2 allows authenticated remote attackers to escape intended directory boundaries and write or execute arbitrary files on the server, leading to full system compromise.

Exploitability

Exploitation requires valid authentication credentials and knowledge of vulnerable endpoints that process user-controlled paths without proper sanitization.

Blast radius

Successful exploitation grants an attacker full administrative control over the affected system, enabling data exfiltration, lateral movement, and persistent backdoor installation across connected infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the official fix for CVE-2026-17239.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.