CVE-2026-17354 is a critical path traversal vulnerability (CVSS 9.9) in IBM API Connect 12.1.0.0 through 12.1.1.2 that could let a remote authenticated attacker write arbitrary files.
What Is It
CVE-2026-17354 is a path traversal weakness (CWE-22) in IBM API Connect. According to the NVD record, which IBM's PSIRT supplied, the flaw "could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal."
NVD published the record on November 7, 2026. Its status is currently "Awaiting Analysis," so NVD has not yet added its own enrichment. The severity data comes from IBM as the CNA.
Why It Matters
IBM rates the flaw 9.9 out of 10, which is CRITICAL. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It breaks down as follows:
- Network attack vector, low complexity: an attacker can exploit it remotely without special conditions.
- Low privileges required: the attacker needs an authenticated account, but not an elevated one.
- No user interaction: no victim has to take any action.
- Changed scope: a successful attack can affect resources beyond the vulnerable component.
- High impact on confidentiality, integrity, and availability.
Arbitrary file writes on an API management platform are dangerous because an attacker may be able to alter configuration or other files the platform relies on. Because only low privileges are needed, any authenticated account could be a way in.
Exploitation status: The supplied CISA KEV data contains no entry for CVE-2026-17354. KEV therefore does not confirm active exploitation at this time. Defenders should still treat the flaw as urgent given its critical score and low attack complexity.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The record lists CPEs for versions 12.1.0.0 and 12.1.1.2 and gives the affected range as 12.1.0.0 up to and including 12.1.1.2.
Patch Status
The NVD record does not name a fixed version or give specific remediation steps. IBM has published a security bulletin for this issue, linked in the sources below. Organizations running affected API Connect versions should:
- Review IBM's bulletin for fixed releases, interim fixes, or mitigations.
- Apply IBM's recommended remediation as soon as possible.
- Review which accounts have authenticated access to API Connect instances until a fix is in place, since exploitation requires only low-privileged credentials.
No CISA required action or due date applies, because the supplied data contains no KEV entry.
Sources
- NVD, CVE-2026-17354
- IBM Security Bulletin (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in the supplied data)