CVE-2026-17359

Summary

IBM API Connect contains a code injection flaw (CWE-94) where an authenticated attacker can influence server-side code generation, leading to arbitrary code execution.

Exploitability

Requires valid authentication and the ability to supply user-controlled input that affects code generation logic; no public exploit exists yet.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) with network-level access, potentially affecting all tenants or services managed by the vulnerable instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or later, or 12.1.1.3 or later, as those versions contain the fix for CVE-2026-17359.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.