CVE-2026-17117 is a critical (CVSS 9.9) flaw in IBM API Connect. An authenticated remote attacker can set fields that only the system should control, and IBM says this could lead to code execution.
What Is It
CVE-2026-17117 is an improperly controlled modification of object attributes in IBM API Connect, classified as CWE-915. IBM's description says a user can set a field that should only be controlled by the system, and that this could lead to code execution. IBM has not publicly said what level of code execution an attacker could reach or what conditions it needs.
IBM's PSIRT is the CNA for this CVE. The record was published on November 7, 2026. NVD lists it as "Awaiting Analysis," so NVD has not yet done its own enrichment.
Why It Matters
IBM scored this flaw 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable: it can be exploited remotely.
- Low complexity: no special conditions are needed.
- Low privileges: any authenticated user can try it, not just administrators.
- No user interaction: a victim does not have to click or do anything.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
API Connect is an API management platform. If many users can log in to a deployment, the "low privileges" requirement does little to stop an attacker.
The supplied CISA KEV entry is empty. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation. There is no KEV remediation deadline.
What's Vulnerable
IBM lists these API Connect version ranges as affected:
| Product | Affected Versions |
|---|---|
| IBM API Connect | 10.0.8.0 through 10.0.8.12 |
| IBM API Connect | 12.1.0.0 through 12.1.1.2 |
The CNA record includes CPE entries for the first and last version in each range (10.0.8.0, 10.0.8.12, 12.1.0.0 and 12.1.1.2).
Patch Status
The NVD record does not name fixed versions or specific remediation steps. IBM has published two support pages for this issue, linked below. Administrators running an affected version should read those advisories for IBM's fix and mitigation guidance.
Because there is no KEV listing, CISA has set no required action or due date. Even so, a 9.9 score combined with low-privilege network access makes this a high-priority patch.