critical · CVSS v3 9.8

CVE-2026-17408

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 are vulnerable to remote code execution via OS command injection. The flaw

Overview

IBM API Connect versions 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 are vulnerable to remote code execution via OS command injection. The flaw arises from improper neutralization of special elements in an OS command. This allows attackers to run arbitrary code on the host system.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.

Impact

Confidentiality: attackers can read sensitive data. Integrity: attackers can modify or delete data. Availability: attackers can disrupt services. The primary impact is on systems running the affected IBM API Connect versions, potentially exposing corporate APIs and backend services.

Remediation

Apply the official IBM security patch that updates API Connect to version 10.0.8.13 or later, or 12.1.1.3 or later. If patching is not immediately possible, isolate the API Connect instances behind a firewall, restrict inbound traffic to trusted IPs, and enable application-level logging to detect suspicious command usage.

Risk context

The CVSS v3 score of 9.8 classifies this as a critical vulnerability, indicating a high likelihood of exploitation. Immediate action is recommended to mitigate potential remote code execution.

Affected products

  • IBM API Connect 10.0.8.x
  • IBM API Connect 12.1.x

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
—
EPSS
—

IBM API Connect Remote Code Execution Command Injection Critical Patch OS Command

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 have a flaw that lets an authenticated user bypass security restrictions, enabling unauthorized access to sensitive data and configuration changes. The vulnerability is rated critical with a CVSS v3 score of 8.8.

View analysis