CVE-2026-17239 is a critical (CVSS 9.9) path traversal flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 that could let a remote authenticated attacker execute arbitrary code.
What Is It
CVE-2026-17239 is a path traversal vulnerability (CWE-22) in IBM API Connect. IBM's PSIRT says a remote authenticated attacker could use it to execute arbitrary code on affected deployments.
IBM's PSIRT published the record to NVD on 2026-11-07. Its status is "Awaiting Analysis," so NVD has not yet added its own enrichment. The CVSS score below comes from IBM as the CNA.
Why It Matters
IBM rates the flaw 9.9 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Attack vector: Network. It can be exploited remotely.
- Attack complexity: Low. No special conditions are required.
- Privileges required: Low. The attacker needs an authenticated account, but not an administrative one.
- User interaction: None.
- Scope: Changed. A successful attack can affect resources beyond the vulnerable component.
- Impact: High to confidentiality, integrity and availability.
API Connect is an API management platform, so it usually sits in front of backend services. Any user with low-privilege access to an affected instance should be treated as a possible route to code execution.
Exploitation status: CVE-2026-17239 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation, and no KEV remediation deadline applies right now.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The NVD record lists CPEs for the start and end of that range (cpe:2.3:a:ibm:api_connect:12.1.0.0 and cpe:2.3:a:ibm:api_connect:12.1.1.2). The version data marks every version in the range as affected.
Patch Status
The NVD record has no fixed version and no specific remediation steps. IBM has published a support bulletin for this issue (node 7295635), and administrators should check it for fix and upgrade guidance.
Until you confirm remediation from that bulletin:
- Find every API Connect instance running 12.1.0.0 through 12.1.1.2.
- Review who holds authenticated access to those instances, since exploitation needs only low privileges.
- Prioritize this flaw because of its critical rating and network attack vector, even though KEV does not list it yet.
Sources
- IBM Support Bulletin (node 7295635)
- NVD: CVE-2026-17239
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)