External risk intelligence

IBM API Connect Path Traversal Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-17147

IBM API Connect is an enterprise solution designed to manage, secure, and expose APIs to the public internet or external partners. As an API gateway and management platform, it is commonly deployed as an internet-facing edge service to facilitate external traffic, making the management and API interfaces frequently reachable from outside the internal network.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability in IBM API Connect could allow a remote authenticated user to execute arbitrary code and perform unauthorized administrative actions. This issue impacts specific versions of the API Connect software, which is used for managing and securing APIs. The main concern is to confirm if these specific versions are in use within our environment.

Allows authenticated users to run unauthorized code.
Affects IBM API Connect software for managing APIs.
Confirm relevance and exposure of affected software.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access could exploit a path traversal vulnerability in IBM API Connect. This flaw allows them to access and potentially manipulate files outside of their intended directory, leading to arbitrary code execution and unauthorized administrative actions.

Requires authenticated access.
Exploits path traversal in file handling.
Leads to code execution and admin control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions on the affected API Connect system. This could occur when the system's supported conditions for path traversal are met, potentially impacting the system's integrity and security.

System configuration and administrative access.
Via a path traversal vulnerability.
Arbitrary code execution and unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts IBM API Connect, a platform commonly exposed to external traffic for API management. Ownership typically falls to the platform or infrastructure teams responsible for the API Connect deployment, in coordination with application owners who utilize the API gateway. The first practical step involves identifying all API Connect instances, confirming their external reachability and business criticality, and then engaging the accountable owners to assess exposure and plan remediation during an upcoming maintenance window.

Platform/Infrastructure teams own the issue.
Verify external reachability and criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect?

IBM API Connect is an enterprise-grade platform used by organizations to create, manage, secure, and distribute APIs. It functions as a central hub that bridges internal services with external applications or partners, controlling how data and functionality are exposed. By acting as an API gateway, it manages the traffic flowing between your private infrastructure and the outside world.

How does CVE-2026-17147 work?

This vulnerability is classified as CWE-22, or path traversal. It occurs when software fails to properly sanitize user input used in file path operations. Because of this flaw in IBM API Connect, an attacker can manipulate input to escape the intended directory, allowing them to access files they should not reach. This unauthorized access can be leveraged to execute arbitrary code or perform administrative tasks.

Do I need to be an administrator to trigger this bug?

No, you do not need administrative access to trigger the vulnerability. However, the attacker must have low-privileged authenticated access to the system. The flaw is not triggered by unauthenticated public traffic; it requires the attacker to have at least a baseline level of access to the API Connect environment to successfully manipulate file paths.

Is my IBM API Connect instance at high risk?

Risk depends heavily on network placement. According to Halo Surface Signal, API Connect is often deployed as an edge service specifically to handle traffic from the public internet or external partners. If your instance is configured to be internet-facing, it is more accessible to remote actors, whereas internal-only instances have a smaller reach.

What are the first steps to address this CVE?

Start by identifying all instances of IBM API Connect within your environment to determine if they run the impacted versions. Once identified, verify their network accessibility and business importance. Finally, coordinate with the infrastructure teams responsible for these systems to assess current configurations and schedule a maintenance window for necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.