CVE-2026-17147 is a critical (CVSS 9.9) path traversal vulnerability in IBM API Connect that could let a remote authenticated attacker execute arbitrary code and perform unauthorized administrative actions.
What Is It
CVE-2026-17147 is a path traversal weakness (CWE-22) in IBM API Connect. According to the NVD record, which IBM PSIRT submitted, the flaw "could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions."
IBM scored the vulnerability CVSS 3.1 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Confidentiality, integrity, and availability impact: High
The CVE was published on November 7, 2026. NVD lists its status as "Awaiting Analysis," so NVD has not yet run its own enrichment.
Why It Matters
An attacker needs only a low-privileged account to exploit this flaw, and the victim does not have to do anything. The attack works over the network, and the "Scope: Changed" rating means a successful exploit can reach resources beyond the vulnerable component itself. Together, code execution and unauthorized administrative actions could give an attacker significant control over an affected API Connect deployment.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. Active exploitation is not confirmed in the source data.
What's Vulnerable
The NVD record lists these IBM API Connect versions as affected:
| Branch | Affected Versions |
|---|---|
| 10.0.8.x | 10.0.8.0 through 10.0.8.12 |
| 12.1.x | 12.1.0.0 through 12.1.1.2 |
Patch Status
IBM PSIRT has published two support advisories for this vulnerability, linked below. The supplied NVD data does not name fixed versions or specific remediation steps. Administrators running an affected version should:
- Review the IBM advisories for fixed releases and mitigation guidance
- Prioritize remediation, given the critical severity and the low privilege needed to exploit the flaw
No CISA KEV required action or due date applies, because no KEV entry was present in the source data.