{"id":"CVE-2026-17340","published":"2026-11-07T05:18:45.510","lastModified":"2026-11-09T15:17:20.137","description":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A path traversal flaw in IBM API Connect versions 12.1.0.0 through 12.1.1.2 allows unauthenticated remote attackers to escape restricted directories and potentially execute arbitrary code by manipulating file paths in requests.","exploitability":"Exploitation is straightforward for remote attackers due to the lack of authentication, authorization, or user interaction required.","blast_radius":"Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability loss across the affected API Connect deployment.","remediation":"Upgrade to IBM API Connect 12.1.1.3 or later, which contains the fix for this path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","rce","web","api"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:57:00.186Z"}}