CVE-2026-17340

Summary

A path traversal flaw in IBM API Connect versions 12.1.0.0 through 12.1.1.2 allows unauthenticated remote attackers to escape restricted directories and potentially execute arbitrary code by manipulating file paths in requests.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication, authorization, or user interaction required.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability loss across the affected API Connect deployment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.