CVE-2026-17342

Summary

A code injection flaw (CWE-94) in IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 allows authenticated remote attackers to execute arbitrary code due to improper control over code generation.

Exploitability

Exploitation requires valid authentication and likely specific input manipulation targeting the code generation component, but otherwise has low barriers (no user interaction or complex conditions).

Blast radius

Successful exploitation could lead to full system compromise including data theft, service disruption, and lateral movement within the environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or to 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.