CVE-2026-17399 json
Multiple Vulnerabilities in IBM API Connect
published 2026-11-07 2 d ago modified 2026-11-09 4 h ago also EUVD-2026-118779
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
Patch / fix
- ibm.com/support/pages/node/7295635 advisory
- ibm.com/support/pages/node/7295637 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 33 h ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
- IBM API Connect
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
-
ibm.com
/support/pages/node/7295635
vendor-advisory, patch
-
ibm.com
/support/pages/node/7295637
vendor-advisory, patch
Sources
- CVE List CVE-2026-17399
- NVD CVE-2026-17399
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.