Act nowDisclosed

Advisory · CVE-2026-17340

IBM API Connect path traversal lets remote attackers execute arbitrary code

IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker execute arbitrary code through a path traversal vulnerability, rated critical at CVSS 9.8.

Advisory published November 7, 2026Independent summary
Vendor
IBM
Product
API Connect
Identifier / CWE
CVE-2026-17340
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

API Connect accepts file paths from the network but does not check that they stay inside the folder they belong in. An attacker can use dot-dot-slash to climb out of the folder and reach files that execute code.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted path sent

    A remote attacker sends a request carrying a path with traversal sequences to API Connect 12.1.0.0 through 12.1.1.2.

  2. 02Path not confined

    The path is not limited to the intended directory, so it escapes the allowed location.

  3. 03Code location reached

    The traversal reaches a location where attacker-controlled content is executed.

  4. 04Arbitrary code executed

    The attacker executes arbitrary code on the server with no authentication.

What happened

IBM disclosed CVE-2026-17340 as part of a multi-vulnerability API Connect bulletin: API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, and no privileges required.

This is one of about 98 CVEs in the same IBM API Connect bulletin; this advisory covers only this CVE. The bulletin text read for this run does not state a fixed release version, so none is claimed here. Unauthenticated remote code execution on an API gateway is a full compromise of the host and the APIs it fronts.

What to do

  1. Inventory IBM API Connect deployments and record each version, including management, gateway, and analytics components.
  2. Apply the fix from IBM’s security bulletin for the affected release lines.
  3. Until patched, restrict network access to the API Connect management and gateway interfaces and treat them as untrusted-input surfaces.
  4. Review access and audit logs for token use by unexpected users, unexpected administrative operations, and requests to internal or metadata addresses.
  5. Rotate API keys, tokens, and credentials if misuse or unauthorized access cannot be excluded.
  6. Verify the deployed version after updating.

Management note

Unauthenticated code execution on the gateway is the worst outcome in this bulletin. Patch first and treat the host as compromised until the logs prove otherwise.