CVE-2026-17399
9.9 CRITICALPublished 2026-11-07 · Updated 2026-11-09
AI risk analysis
- Summary
- IBM API Connect contains a code-execution flaw (CWE-434) where uploaded content is insufficiently validated before processing, allowing an authenticated attacker to execute arbitrary code on the server.
- Exploitability
- Requires authentication and network access; low complexity due to lack of input sanitization on uploads.
- Blast radius
- Successful exploitation grants full server compromise (confidentiality, integrity, availability) with potential impact across all tenants or services relying on the affected API Connect instance.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x stream, or to 12.1.1.3 or later for the 12.1.x stream.
rceuploadcwe-434api-connectauthenticated
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-434
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-17335
- CRITICALCVE-2023-54405PoC
- CRITICALCVE-2026-104028
- CRITICALCVE-2026-107188
- HIGHCVE-2026-12264
- CRITICALCVE-2026-14175
- CRITICALCVE-2026-18143
- CRITICALCVE-2026-39759
Related by shared AI tags and CWE weakness class. Browse the full archive.