CVE-2026-17342 is a critical (CVSS 9.9) code injection flaw in IBM API Connect that could let a remote authenticated attacker run arbitrary code.
What Is It
CVE-2026-17342 is a code injection vulnerability in IBM API Connect, classified as CWE-94 (Improper Control of Generation of Code). According to the NVD record, which IBM's PSIRT supplied, the flaw "could allow a remote authenticated attacker to execute arbitrary code."
The NVD published the record on 2026-11-07. Its status is "Awaiting Analysis," so NVD has not yet added its own assessment. The score and vector come from IBM.
Why It Matters
IBM rated the flaw 9.9, which is Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable: an attacker can exploit it remotely, with low attack complexity.
- Low privileges required: the attacker needs to be authenticated, but only with a low-privilege account.
- No user interaction: no victim has to click or do anything.
- Scope changed: a successful attack can affect resources beyond the vulnerable component itself.
- High impact: confidentiality, integrity and availability are all rated high.
API Connect manages and exposes APIs, so it often sits at the edge of a network. Because any low-privilege authenticated account is enough, a stolen or weak credential could become code execution.
Exploitation status: CVE-2026-17342 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation at this time. The supplied data contains no public exploitation reports.
What's Vulnerable
The NVD record lists these affected IBM API Connect versions:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running any release in these ranges should treat their deployments as affected.
Patch Status
IBM has published two security bulletins for this CVE, linked below. The supplied data does not name fixed versions or specific remediation steps. Administrators should read the IBM bulletins for upgrade paths or fixes for their release line.
There is no CISA KEV entry, so CISA has set no required action or federal remediation deadline. Given the critical score and low barrier to exploitation, prioritize patching anyway, especially on internet-facing API Connect instances.