Brief Summary: IBM API Connect CVE-2026-17340 Unauthenticated Path Traversal Leading to Remote Code Execution

Introduction

IBM has disclosed a path traversal flaw in API Connect V12 OnPrem that, according to its own assessment, could let a remote attacker execute arbitrary code without credentials or user interaction. API Connect sits in the middle of API publication, governance and consumption workflows, so a 9.8-rated issue here affects infrastructure that many organizations use to expose services to partners and developers.

IBM API Connect is an API management platform that combines an enterprise gateway, an API manager, testing capabilities, developer tooling and a Developer Portal. IBM offers it for on-premises, cloud, hybrid and SaaS deployments. On 1 October 2026, IBM announced that it was recognized as a Leader in the 2026 Gartner Magic Quadrant for API Management for the 11th consecutive time (a vendor-published account; Gartner states it does not endorse vendors depicted in its research). That position makes API Connect a common control point between internal services and external consumers.

One housekeeping note: the CVE data we started from lists the vendor as "Unknown". The CNA for this record is IBM Corporation, and the affected product is IBM API Connect.

Technical information

Root cause

IBM classifies CVE-2026-17340 as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. MITRE defines this weakness as software that uses external input to construct a pathname intended to stay within a restricted parent directory, but fails to properly neutralize elements that cause the path to resolve to a location outside that directory.

IBM's description connects that traversal to a much more serious outcome: arbitrary code execution by a remote attacker. IBM has not published how the path traversal leads to code execution. The bulletin does not name:

• the vulnerable endpoint or API route
• the parameter or field carrying the attacker-controlled path
• the filesystem operation involved (read, write, extraction, include, or otherwise)
• the subsystem (management, portal, analytics, gateway, and so on) that contains the flaw
• the executable resource that makes code execution possible

API Connect is proprietary, so there is no public commit, diff, vulnerable function or source code to examine. We are not reproducing any code here because none has been published.

CVSS vector

IBM, as CNA, assigned the following CVSS 3.1 vector. NVD had not supplied its own assessment in the retrieved record.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV:N): Network
• Attack Complexity (AC:L): Low
• Privileges Required (PR:N): None
• User Interaction (UI:N): None
• Scope (S:U): Unchanged
• Confidentiality (C:H), Integrity (I:H), Availability (A:H): High

Under the FIRST CVSS v3.1 specification, high confidentiality impact means total loss of confidentiality or disclosure with a direct, serious impact. High integrity impact includes a complete loss of protection, and high availability impact includes fully denying access to resources in the impacted component. These describe the potential severity captured by the score, not observed outcomes from attacks on this CVE.

The PR:N value is what sets this CVE apart. The same IBM bulletin addresses well over 100 API Connect vulnerabilities, including several other path traversal issues such as CVE-2026-17335, CVE-2026-17354, CVE-2026-17147 and CVE-2026-17239. Most of those require authentication. CVE-2026-17340 does not, which is why it is among the most severe issues in the release.

Attack flow, as far as public information allows

The public record supports only a high-level description of how exploitation would proceed:

1. The attacker needs network reachability to a component of an affected API Connect V12 OnPrem deployment (AV:N).
2. No account, token or prior access is needed (PR:N), and no victim has to click or open anything (UI:N).
3. The attacker supplies input that the application uses to build a filesystem path. Because traversal elements are not properly neutralized (CWE-22), the resolved path escapes the directory the application intended to restrict it to.
4. According to IBM, this can result in arbitrary code execution. The specific mechanism is undisclosed.
5. Successful exploitation carries high confidentiality, integrity and availability impact within the affected component (S:U).

The public detail stops at steps 3 and 4. Any claim about specific URLs, payloads or file targets for this CVE would be speculation, and we are not offering any.

Exploitation status

The reviewed reporting does not publicly confirm active exploitation:

• OffSeq's Threat Radar reports no evidence of exploitation in the wild and no attack traffic observed by its Mirage telemetry. It also reports no indexed public Nuclei template and no indexed exploit in Metasploit or Exploit DB. These are bounded observations about the sources it checks, not proof that no private exploit exists.
• The retrieved CISA Known Exploited Vulnerabilities catalog (version 2026.11.06, released 6 November 2026) contains no entry for CVE-2026-17340. That snapshot predates the 7 November 2026 NVD publication, so it cannot tell us whether a later catalog update adds it.
• No threat actor, ransomware operation, campaign, victim organization or indicators of compromise have been established for this CVE.

Timeline

• 3 October 2026: All API Connect 12.1.1.3 files on IBM's release page carry this date.
• 5 November 2026: IBM security bulletin (document 7295635) initially published.
• 7 November 2026: CVE record and NVD entry published.

IBM shipped the fix roughly a month before disclosing the vulnerability, so customers who installed 12.1.1.3 when it was released were protected before the issue was announced. These dates say nothing about when the flaw was first discovered or whether exploitation began at any point.

Patch information

The fix is a product release, not a hotfix. IBM fixed CVE-2026-17340 in IBM API Connect v12.1.1.3. In the Remediation section of bulletin 7295635, IBM says it "strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3". The bulletin lists the affected range as V12 OnPrem v12.1.0.0 through v12.1.1.2, and NVD shows the same range, making 12.1.1.3 the first fixed version.

The bulletin's document metadata has one oddity. Its range label gives the version as "v12.1.0.0 to v12.1.1.3". The affected versions table and the remediation text both treat 12.1.1.3 as the fixed release, so the metadata appears to be a labeling error.

What is not public. IBM has published no commit, diff or code-level description of how the traversal was closed. Fixes for this class of bug usually resolve a user-supplied path to its canonical form and reject anything outside an allowed base directory, but that is general background, not confirmed IBM behavior. Without a published diff, any claim about exactly what changed in 12.1.1.3 is guesswork.

What to install. The bulletin does not identify which subsystem contains the flaw, so upgrade every API Connect subsystem in the deployment to 12.1.1.3. IBM's release page (node 7290205), which states the release "delivers important security updates", provides artifacts for each deployment model:

• Containers / Kubernetes: apiconnect-image-tool_12.1.1.3.tar.gz and apiconnect-operator-release-files_12.1.1.3.zip
• VMware (OVA) upgrades: per-subsystem files including upgrade_management_12.1.1.3.tgz, upgrade_portal_12.1.1.3.tgz, upgrade_devportal_12.1.1.3.tgz, upgrade_analytics_12.1.1.3.tgz, upgrade_federatedapimanagement_12.1.1.3.tgz and upgrade_wmapigateway_12.1.1.3.tgz. Some OVA upgrades may also need the optional control-plane file appliance-control-plane-1.35.9.tgz to bring Kubernetes to a supported level. This is deployment specific, not universal.
• Tooling: the apicup Install Assist, apicupgrade and toolkit binaries for Linux, macOS and Windows, all at 12.1.1.3
• Integrity check: 12.1.1.3_signatures.zip, a signature bundle for verifying downloaded files before deployment

Downloads require IBM entitlement through Fix Central. The fix is publicly documented, but the binaries are available only to licensed customers.

No workaround. The bulletin's Workarounds and Mitigations section reads "None". Upgrading to 12.1.1.3 is the only remediation IBM offers for this vulnerability.

Affected systems and versions

• Product: IBM API Connect V12 OnPrem
• Affected versions: 12.1.0.0 through 12.1.1.2 (inclusive)
• First fixed version: 12.1.1.3
• Platform listed in bulletin metadata: Linux
• Configuration notes: The CVSS vector requires no authentication, so no specific feature or account configuration is documented as a precondition. Because the vulnerable subsystem is not named, treat all subsystems in an affected deployment as in scope.

IBM offers API Connect in other deployment models (cloud, hybrid, SaaS), but the bulletin scopes this issue to V12 OnPrem. The reviewed sources do not establish that other offerings are affected, and we would not assume they are without confirmation from IBM.

Vendor security history

The most relevant prior case is CVE-2025-13915, an authentication bypass in IBM API Connect. IBM stated that internal testing revealed the issue, scored it CVSS 9.8, and published interim fix guidance for listed V10 versions. That bulletin first appeared on 17 December 2025 and was modified on 25 December 2025.

For CVE-2025-13915, IBM documented a conditional workaround: disabling Developer Portal self-service sign-up for customers who could not install the interim fix. That workaround belongs to the earlier authentication bypass. It does not mitigate CVE-2026-17340, whose bulletin lists no workaround at all.

Comparing the two:

• Mechanism: authentication bypass (2025) versus path traversal with possible code execution (2026)
• Scope: listed V10 versions versus V12 OnPrem 12.1.0.0 through 12.1.1.2
• Response: interim fixes plus a conditional workaround versus a full upgrade to 12.1.1.3 with no workaround

Both cases show IBM publishing disclosures and remediation guidance for API Connect. Neither tells us how widely customers applied the fixes. Market recognition and security posture are separate questions, and the reviewed evidence does not support ranking IBM's security track record against other API management vendors.

References

• NVD: CVE-2026-17340
• CVE Record (CVE Services API): CVE-2026-17340
• IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (node 7295635)
• IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (bulletin 39)
• IBM API Connect v12.1.1.3 is now available (node 7290205)
• IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (node 7295637)
• IBM Security Bulletin: Authentication bypass in IBM API Connect (CVE-2025-13915)
• MITRE CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• FIRST CVSS v3.1 Specification Document
• CISA Known Exploited Vulnerabilities Catalog (JSON feed)
• VulDB: CVE-2026-17340
• OffSeq Threat Radar: CVE-2026-17340
• IBM API Connect Features
• IBM named a Leader in the 2026 Gartner Magic Quadrant for API Management