CVE-2026-17408 is a critical (CVSS 9.8) OS command injection vulnerability in IBM API Connect that could allow a remote attacker to execute arbitrary code.
What Is It
CVE-2026-17408 is a flaw in IBM API Connect caused by improper neutralization of special elements used in an OS command (CWE-78, OS command injection). According to the NVD record, a remote attacker could exploit the issue to execute arbitrary code on affected systems.
IBM's PSIRT ([email protected]) reported the vulnerability, and it was published to NVD on November 7, 2026. Its NVD status is currently "Awaiting Analysis," so NVD has not yet added its own enrichment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network-exploitable: an attacker can reach it remotely.
- Low attack complexity: no special conditions are needed.
- No privileges or user interaction required: an attacker without authentication can trigger it.
- High impact on confidentiality, integrity and availability
API Connect is an API management platform, so it often sits in front of internal services and is reachable from untrusted networks. An attacker who can run arbitrary code on it, with no login and no user action, could fully compromise the affected system.
KEV status: CVE-2026-17408 is not listed in the CISA Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation. Given the severity and the lack of authentication needed, it should still be treated as a high priority.
What's Vulnerable
The NVD record lists these affected IBM API Connect versions:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Organizations running API Connect in either range should treat their deployments as vulnerable.
Patch Status
The supplied data does not name specific fixed versions. IBM has published two security bulletins on its support portal for this CVE (listed below). Administrators should read both bulletins for IBM's fix and mitigation guidance and apply the vendor's remediation to any affected API Connect deployment as soon as possible.
Because the CVE is not in the CISA KEV catalog, there is no federal required action or due date for it.