CVSS 9.9 (critical) · published 2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
Affected products (NVD): ibm api_connect
Fixed in (NVD): 10.0.8.13, 12.1.1.3
Weakness: CWE-184
Source: NVD CVE-2026-17150
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.