CVE-2026-17340 is a critical (CVSS 9.8) path traversal vulnerability in IBM API Connect 12.1.0.0 through 12.1.1.2 that could allow a remote attacker to execute arbitrary code.
What Is It
CVE-2026-17340 is a path traversal weakness (CWE-22) in IBM API Connect. IBM's PSIRT describes it this way: the flaw "could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability."
IBM published the CVE on November 7, 2026. NVD lists it as "Awaiting Analysis," so NVD has not yet added its own enrichment. The severity data below comes from IBM as the CNA.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice that means:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges required: the attacker does not need an account.
- No user interaction: no victim has to click or open anything.
- High impact: confidentiality, integrity and availability are all fully affected.
API Connect is an API management platform, so it often sits at the edge of an organization's network. An unauthenticated code execution flaw in that position deserves urgent attention.
Exploitation status: CVE-2026-17340 is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation. Watch for a KEV listing, which would also set a federal remediation deadline.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
IBM's CPE data names 12.1.0.0 and 12.1.1.2 as the range boundaries. Any deployment running a version in that range should be treated as vulnerable.
Patch Status
IBM has published a security bulletin for this vulnerability (linked below). The supplied NVD record does not name a fixed version, and since the CVE is not in KEV, no CISA required action applies yet. Administrators should:
- Read the IBM bulletin for fixed releases or interim fixes.
- List every API Connect instance running 12.1.0.0 through 12.1.1.2.
- Patch internet-facing deployments first, because the flaw needs no authentication.