CVE-2026-17408

Summary

IBM API Connect contains a command injection vulnerability (CWE-78) in versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2, allowing unauthenticated remote attackers to execute arbitrary OS commands due to insufficient sanitization of user-supplied input.

Exploitability

Exploitation is straightforward for remote attackers since no authentication or user interaction is required (CVSS AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation grants full system compromise—confidentiality, integrity, and availability impact—as the attacker gains arbitrary command execution on the affected API Connect management or gateway node.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x branch, or 12.1.1.3 or later for the 12.1.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.