CVE-2026-17150 is a critical (CVSS 9.9) input validation flaw in IBM API Connect that could let a remote authenticated attacker run arbitrary code and read sensitive data belonging to other tenants.
What Is It
IBM's description says API Connect does not validate uploaded custom module content well enough before processing it. An authenticated attacker can use this to run arbitrary code with access beyond their own tenant, which exposes other tenants' sensitive information.
The flaw is classified as CWE-184 (Incomplete List of Disallowed Inputs). IBM PSIRT reported it, and NVD published it on 2026-11-07. NVD has not analyzed it yet; its status is "Awaiting Analysis."
Why It Matters
IBM PSIRT scores the flaw 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable and low complexity
- Low privileges needed and no user interaction
- Scope changed: the impact reaches past the attacker's own security boundary, here into other tenants
- High impact to confidentiality, integrity and availability
A low-privileged tenant account is enough to start an attack. That makes this especially serious for shared or multi-tenant API Connect deployments, where one tenant's account could expose others.
This CVE has no CISA KEV entry in the supplied data, so KEV does not confirm active exploitation at this time.
What's Vulnerable
IBM API Connect, in these version ranges:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Patch Status
The supplied data contains no CISA KEV entry, so there is no federal remediation deadline or required action. The NVD record does not name fixed versions. IBM has published two support pages for this issue (listed below). Administrators running affected versions should check those advisories for fixed releases and remediation steps, and should prioritize multi-tenant deployments given the cross-tenant impact.