Critical 9.9

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute...

CVE-2026-17239 First seen on SecPulse Nov 7, 13:32

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
IBM	IBMAPI Connect	12.1.0.0 – 12.1.1.2→ Not listed	Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Original description The description as published by the source.

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Critical 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Nov 7, 2026
First seen on SecPulse: Nov 7, 13:32
GHSA: GHSA-pc6g-x7j7-3wpv
CWE: CWE-22

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Path Traversal

CWE

CWE-22

Vendors

Ibm

All

Api Connect

Detection sources

NIST National Vulnerability Database01:54
GitHub Security Advisories (Global)Nov 7, 15:31
CVE.org (CVE Program・cvelistV5)Nov 10, 00:12