{"id":"CVE-2026-17410","published":"2026-11-07T05:18:58.410","lastModified":"2026-11-07T05:18:58.590","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7295635","tags":[]},{"url":"https://www.ibm.com/support/pages/node/7295637","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM API Connect contains a command injection flaw (CWE-88) in its portal component that allows authenticated low-privileged attackers to manipulate argument delimiters and execute arbitrary commands with elevated privileges, potentially accessing or modifying other tenants' data due to improper neutralization of user-supplied input.","exploitability":"Exploitation requires valid authentication as a low-privileged user and precise manipulation of argument delimiters in portal-related input fields; the vulnerability is exploitable remotely without user interaction.","blast_radius":"A successful exploit could lead to cross-tenant data access or modification, full compromise of tenant isolation, and potential lateral movement across the multi-tenant API management infrastructure.","remediation":"Upgrade IBM API Connect to version 10.0.8.13 or 12.1.1.3 (or later), as these versions contain the vendor-provided fix for the argument delimiter neutralization flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["command-injection","tenant-isolation-bypass","multi-tenant","api-management"],"model":"garnet-coder","analyzedAt":"2026-11-07T09:47:36.522Z"}}