A critical code injection vulnerability (CVSS 9.9) in IBM API Connect could let a remote, authenticated attacker execute arbitrary code by passing a crafted value that shapes code the product generates.
What Is It
CVE-2026-17359 comes from IBM API Connect not properly controlling how it generates code. It is classified as CWE-94 (Improper Control of Generation of Code, or "Code Injection"). IBM's description says a user-supplied value can influence code that the product generates, which could lead to code execution. The flaw was published on 2026-11-07. Its NVD status is "Awaiting Analysis".
Why It Matters
IBM PSIRT gives the flaw a CVSS v3.1 base score of 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Here is what that vector means:
- Network-reachable: an attacker can exploit it remotely, and attack complexity is low.
- Low privileges required: the attacker needs an authenticated account, but not an elevated one.
- No user interaction is needed.
- Scope changed: a successful attack can affect resources beyond the vulnerable component.
- High impact to confidentiality, integrity, and availability.
API Connect usually sits in front of an organization's APIs. That makes it a valuable target, because any low-privileged authenticated user could become a path to code execution.
As of this writing, the CISA Known Exploited Vulnerabilities (KEV) catalog does not list CVE-2026-17359. The supplied data does not confirm active exploitation.
What's Vulnerable
According to the NVD record, these IBM API Connect versions are affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running any release in these ranges should treat their deployments as exposed.
Patch Status
IBM has published two support advisories for this CVE, listed under Sources. The supplied NVD data does not name fixed versions or specific remediation steps, and there is no CISA KEV required action or due date. Administrators should read the IBM advisories to confirm the fixed releases and apply IBM's remediation guidance. Given the critical score and the low privilege needed to exploit it, patching should be a priority.