CVE-2026-17150 json
Multiple Vulnerabilities in IBM API Connect
published 2026-11-07 2 d ago modified 2026-11-09 9 h ago also EUVD-2026-118645
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
Patch / fix
- ibm.com/support/pages/node/7295635 advisory
- ibm.com/support/pages/node/7295637 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 38 h ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
- IBM API Connect
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
-
ibm.com
/support/pages/node/7295635
vendor-advisory, patch
-
ibm.com
/support/pages/node/7295637
vendor-advisory, patch
Sources
- CVE List CVE-2026-17150
- NVD CVE-2026-17150
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.