CVE-2026-17410

Summary

IBM API Connect contains a command injection flaw (CWE-88) in its portal component that allows authenticated low-privileged attackers to manipulate argument delimiters and execute arbitrary commands with elevated privileges, potentially accessing or modifying other tenants' data due to improper neutralization of user-supplied input.

Exploitability

Exploitation requires valid authentication as a low-privileged user and precise manipulation of argument delimiters in portal-related input fields; the vulnerability is exploitable remotely without user interaction.

Blast radius

A successful exploit could lead to cross-tenant data access or modification, full compromise of tenant isolation, and potential lateral movement across the multi-tenant API management infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 (or later), as these versions contain the vendor-provided fix for the argument delimiter neutralization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.