{"id":"CVE-2026-17399","published":"2026-11-07T05:18:55.790","lastModified":"2026-11-09T05:18:32.913","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a code-execution flaw (CWE-434) where uploaded content is insufficiently validated before processing, allowing an authenticated attacker to execute arbitrary code on the server.","exploitability":"Requires authentication and network access; low complexity due to lack of input sanitization on uploads.","blast_radius":"Successful exploitation grants full server compromise (confidentiality, integrity, availability) with potential impact across all tenants or services relying on the affected API Connect instance.","remediation":"Upgrade to IBM API Connect 10.0.8.13 or later for the 10.0.8.x stream, or to 12.1.1.3 or later for the 12.1.x stream.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","upload","cwe-434","api-connect","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:47:04.964Z"}}