Introduction
IBM has patched a path traversal flaw in API Connect that, by its own assessment, lets an authenticated user with low privileges execute arbitrary code and perform unauthorized administrative actions. IBM rates the issue 9.9 Critical, and its bulletins name upgrading as the only remediation. For any organization that routes its API program through the platform, that means an upgrade.
IBM API Connect is an API management solution that brings an organization's APIs together in one place. IBM currently positions it around AI-assisted API development and runtime policy enforcement and visibility. IBM also states that Gartner recognized it as a Leader in the 2026 Magic Quadrant for API Management for the 11th time. Gartner's public report page, published 28 September 2026, lists IBM among the evaluated vendors. Because of that market presence, API Connect advisories are relevant to a broad set of enterprise API programs.
The CVE data we received lists the vendor as Unknown, but IBM is both the affected supplier and the CVE Numbering Authority for this entry.
Technical information
Root cause
IBM classifies CVE-2026-17147 as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. MITRE defines this weakness as software constructing a pathname from external input without properly neutralizing elements that can cause the path to resolve outside an intended restricted directory. As a result, an attacker can reach files or directories the application never meant to expose. Among the general consequences MITRE lists for this class is creating or overwriting critical files used to execute code.
IBM's description connects the traversal to two outcomes: arbitrary code execution and unauthorized administrative actions by a remote authenticated attacker.
What IBM has not disclosed is just as important for defenders. The bulletins, the CVE record and the NVD entry do not identify:
- the affected endpoint or API Connect subsystem
- the request parameter carrying the path
- the file operation involved (read, write, extract, include)
- the destination path or execution context
- the required account role, beyond the low-privilege CVSS rating
API Connect is closed source. There is no public commit, diff or changed file list, and the reviewed sources contain no vulnerable code, payload or exploit. We therefore do not show any code here, and we cannot describe IBM's specific fix.
CVSS breakdown
IBM's vector, displayed by NVD with IBM as the source (NVD has not published an independent NIST score):
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack Vector: Network. The flaw is remotely reachable.
- Attack Complexity: Low. This is IBM's assessment, not a published exploit procedure.
- Privileges Required: Low. Some authenticated access is needed. FIRST describes this level as basic user capabilities.
- User Interaction: None. No other user has to take any action.
- Scope: Changed. The impact can extend beyond the security authority of the vulnerable component. IBM does not say which boundary is crossed, so this should not be read as a specific operating system account, downstream component or cross-tenant path.
- Confidentiality, Integrity, Availability: High.
The 9.9 score despite the authentication requirement comes from the combination of low complexity, no user interaction, changed scope and high impact across all three properties. It is still an authenticated issue, and should not be confused with an unauthenticated bypass.
Attack flow
With no product-specific technical detail public, the sequence can only be described at the level the CVSS vector and the CWE class support:
- The attacker holds a low-privilege account on an affected API Connect deployment. The vector rules out unauthenticated exploitation.
- Over the network, the attacker supplies input that the application uses to construct a file path. No interaction from another user is required.
- Because path elements are not properly neutralized, the resolved path lands outside the intended restricted directory.
- According to IBM, successful exploitation yields arbitrary code execution and unauthorized administrative actions, and the changed scope rating indicates the impact reaches beyond the vulnerable component.
Which file is reached, which code path executes, and under what privileges the resulting code runs are not public. The available sources do not support claims of root-level execution.
Exploitation status and timeline
- 5 November 2026: IBM publishes branch-specific security bulletins 7295635 and 7295637.
- 2026-11-07T04:32:01.885Z: IBM's CVE record is published.
- 2026-11-07T05:18:28.037: NVD publishes the record with IBM as source.
As of 7 November 2026, a search of the CISA Known Exploited Vulnerabilities catalog for this CVE returns no result. The Threat Radar tracker reports no evidence of exploitation in the wild, no public exploit code indexed in Metasploit or Exploit DB, and no public Nuclei template. Its underlying index date is 6 November 2026, one day before the CVE was published, so those negative findings say little about activity after disclosure. No threat actor or campaign has been named. We treat exploitation and attribution as unconfirmed, not disproven.
Patch information
IBM fixed CVE-2026-17147 by shipping new product releases rather than a standalone hotfix. The only verifiable patch evidence is IBM's two security bulletins (both published 5 November 2026), the release resources they link to, and the CVE record. Both the CVE record and NVD tag the bulletins as vendor-advisory and patch references.
Fixed versions by release stream
- API Connect V12 (OnPrem): vulnerable 12.1.0.0 through 12.1.1.2, fixed in 12.1.1.3. See Bulletin 7295635, which links to the 12.1.1.3 release notes (node 7290205).
- API Connect V10.0.8 (LTS): vulnerable 10.0.8.0 through 10.0.8.12, fixed in 10.0.8.13. See Bulletin 7295637, which links to Fix Central (release filter 10.0.8.12).
Each fix applies to its own branch. There is no requirement to move every installation to the same major release.
Both bulletins carry the same guidance: "IBM strongly recommends addressing the vulnerability now by upgrading" to the fixed level. Under Workarounds and Mitigations, both state "None". There is no configuration switch, firewall rule, WAF signature or interim fix.
What 12.1.1.3 contains
IBM describes 12.1.1.3 as a release that "delivers important security updates for API Connect customers." It was published on Fix Central on 3 October 2026 as a full set of component updates, including:
- Management, Analytics, Developer Portal, CMS Portal, Federated API Management and webMethods API Gateway OVA images, plus their
upgrade_*_12.1.1.3.tgzfiles - Container artifacts, including the API Connect image tool archive and operator release files
apicup,apicupgradeand toolkit binaries for Linux, macOS and Windows- A signature bundle,
12.1.1.3_signatures.zip, for verifying the downloads - Optional Kubernetes control plane updates for VMware/OVA upgrades
Downloads require IBM product entitlement.
One fix among many
Both bulletins cover over 100 CVEs fixed together, including several other CWE-22 path traversal flaws such as CVE-2026-17239, CVE-2026-17335, CVE-2026-17340 and CVE-2026-17354. The 12.1.1.3 release notes list only functional defect fixes (for example DT500436 and DT501638) and do not identify which component or code path changed for CVE-2026-17147.
Verifying remediation
A deployment is fixed only when every API Connect subsystem reports 12.1.1.3 (V12) or 10.0.8.13 (V10.0.8). Upgrading the Management server while Portal, Analytics or the gateway remain on older images does not count.
For background only: the usual fix for this bug class is to resolve the user-supplied path to its final canonical form and reject anything outside the allowed base directory. MITRE also recommends accepting known-good input and strict filename allowlists rather than relying solely on stripping dangerous characters. IBM has not said what it actually changed, so this is general guidance, not a description of IBM's patch.
Conflicting claim (unconfirmed): One upstream source stated the fix ships in 12.1.1.4, released 6 November 2026. IBM's bulletin and the CVE record both name 12.1.1.3, and no IBM source for a 12.1.1.4 release was found. The fixed versions above come from IBM's own documents.
Affected systems and versions
- IBM API Connect 10.0.8: versions 10.0.8.0 through 10.0.8.12, inclusive. Fixed in 10.0.8.13.
- IBM API Connect V12 OnPrem: versions 12.1.0.0 through 12.1.1.2, inclusive. Fixed in 12.1.1.3.
Exploitation requires a remote attacker with low-privilege authenticated access. The advisories do not establish the status of other API Connect releases, deployment models or components simply by leaving them out, so the absence of a release from these ranges should not be taken as confirmation that it is unaffected.
Vendor security history
API Connect has had at least one recent critical issue. On 17 December 2025, IBM published a bulletin for CVE-2025-13915, an authentication bypass found through internal testing. IBM stated it could let a remote attacker bypass authentication mechanisms and gain unauthorized access to the application. Singapore's Cyber Security Agency issued an alert rating it CVSS 3.1 9.8.
The two issues differ in mechanism. CVE-2025-13915 bypasses authentication, while CVE-2026-17147 requires an authenticated attacker exploiting path traversal. Nothing in the sources establishes a shared root cause, a chain between them, or exploitation of either in a specific campaign.
On process, IBM runs a centralized PSIRT for vulnerability reporting, describes a risk-based workflow influenced by the FIRST framework (discovery, triage, remediation, disclosure), and offers a Safe Harbor Policy for researchers. These describe a formal response structure. They are not measured response times or comparative performance data.
References
- NVD entry for CVE-2026-17147
- Official CVE record (CVE Services API)
- CVE List V5 commit adding the record
- IBM Security Bulletin 7295635: Multiple Vulnerabilities in IBM API Connect (V12)
- IBM Security Bulletin 7295637: Multiple Vulnerabilities in IBM API Connect (10.0.8)
- IBM API Connect v12.1.1.3 release notes
- NVD API record
- MITRE CWE-22: Path Traversal
- FIRST CVSS v3.1 Specification
- CISA Known Exploited Vulnerabilities Catalog search
- Threat Radar entry for CVE-2026-17147
- VulDB entry for CVE-2026-17147
- IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
- Cyber Security Agency of Singapore alert on IBM API Connect
- IBM security vulnerability management (PSIRT)
- IBM: 2026 Gartner Magic Quadrant for API Management
- Gartner Magic Quadrant for API Management
- IBM: What are the benefits of API Connect
