CriticalCritical vulnerability

CVE-2026-17399 (CVSS 9.9)

NVD · officialPublished Nov 7, 2026Risk 50/100EPSS 0.8%

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.

Technical details

CVSS

9.9

AV:NetworkAC:LowPR:LowUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source