Advisory · CVE-2026-17117
IBM API Connect mass assignment flaw lets authenticated attackers execute arbitrary code
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker execute arbitrary code by setting object fields that should only be controlled by the system, rated critical at CVSS 9.9.
- Vendor
- IBM
- Product
- API Connect
- Identifier / CWE
- CVE-2026-17117
CWE-915 - Action timing
- Immediate
Explain it like I’m five
API Connect lets you fill in a form, but it does not check which boxes you are allowed to touch. An attacker can fill in a hidden box that only the system should control, and that box leads straight to running their code.
- 01Authenticated request sent
A remote authenticated attacker sends a request carrying object attributes to API Connect.
- 02System-only field set
The attacker sets a field that should only be controlled by the system, and the application accepts it.
- 03Object modified
The improperly controlled modification changes the object in a way the attacker controls.
- 04Arbitrary code executed
The modified object leads to execution of attacker-supplied code on the server.
What happened
IBM disclosed CVE-2026-17117 as part of a multi-vulnerability API Connect bulletin: API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and changed scope.
This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Authenticated remote code execution on an API platform is a full compromise of the host and everything it can reach.
What to do
- Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
- Apply the fix from IBM’s security bulletin for the affected release lines.
- Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
- Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
- Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
- Verify the deployed version after updating.
Management note
Remote code execution from an ordinary authenticated account means the platform itself is the prize. Patch, then assume the host was reachable for code execution and check accordingly.