CVE-2026-17339 is a path traversal flaw in IBM API Connect 12.1.0.0 through 12.1.1.2. IBM rates it critical (CVSS 9.1). IBM says it could let a remote authenticated attacker access or delete resources that belong to other tenants.
What Is It
CVE-2026-17339 is a path traversal weakness (CWE-22) in IBM API Connect. IBM's description says a remote attacker who is authenticated could exploit the flaw to access or delete resources that belong to other tenants.
IBM PSIRT assigned a CVSS v3.1 base score of 9.1 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. NVD has not yet scored it independently. The vector breaks down as follows:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: Low confidentiality, high integrity, low availability
NVD published the record on 2026-11-07. It is still marked "Awaiting Analysis."
Why It Matters
API Connect is often run as a shared, multi-tenant platform. IBM's description indicates the flaw could weaken the separation between tenants by letting an authenticated user reach resources outside their own tenant. The CVSS scope is "Changed," which means a successful exploit could affect resources beyond the attacker's own permissions. The integrity impact is rated High, which matches IBM's statement that resources could be deleted as well as read.
The attacker needs only low privileges. Any user with a valid account could be a threat, including a user in a low-trust tenant. No user interaction is required, and attack complexity is low.
Exploitation status: CVE-2026-17339 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The source data lists no other products or version branches.
Patch Status
IBM has published a security bulletin for this vulnerability (linked below). The supplied NVD record does not name a fixed version or specific remediation steps. Administrators running API Connect 12.1.0.0 through 12.1.1.2 should read the IBM bulletin for fix and mitigation guidance. They should treat the issue as a priority, given its critical rating and potential cross-tenant impact.
There is no CISA KEV entry, so no federal remediation deadline or required action applies at this time.