CVE-2026-17399 is a critical (CVSS 9.9) unrestricted file upload vulnerability in IBM API Connect. A remote authenticated attacker could use it to execute arbitrary code on the server.
What Is It
IBM's description of CVE-2026-17399 says IBM API Connect does not properly validate uploaded content. Uploaded content is not checked well enough before the product processes it, which could let code run on the server. The weakness is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
IBM's PSIRT published the record on 2026-11-07. NVD lists it as "Awaiting Analysis," so NVD has not yet done its own independent scoring or enrichment.
Why It Matters
IBM assigns a CVSS v3.1 base score of 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: the attacker does not need local access.
- Low complexity: no special conditions are needed for the attack to succeed.
- Low privileges: the vector rates the required privileges as low, meaning a low-privileged authenticated account may be sufficient and admin rights are not required.
- No user interaction: no victim has to click anything.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High impact on confidentiality, integrity and availability.
API Connect manages API traffic and access. Remote code execution on that platform could expose the backend services and data it brokers.
Exploitation status: CVE-2026-17399 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The source material does not confirm any active exploitation, and no CISA-mandated remediation deadline applies.
What's Vulnerable
IBM lists these IBM API Connect versions as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Patch Status
IBM has published two security bulletins for this vulnerability (linked below). The supplied NVD record does not name fixed versions or specific remediation steps. Organizations running affected API Connect versions should:
- Read IBM's bulletins for fixed releases and any interim mitigations.
- Prioritize remediation given the critical severity and low-privilege, network-based attack path.
- Review which authenticated users and accounts can upload content to API Connect.
There is no KEV entry, so CISA has issued no required action.