External risk intelligence

IBM API Connect Code Generation Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-17359

IBM API Connect is an enterprise API management solution designed to be deployed as an internet-facing gateway or API management portal. Given its core function of mediating and managing external-facing API traffic, it is commonly positioned at the edge of a network, making it a likely candidate for public internet reachability in standard deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in IBM API Connect that could allow an authenticated attacker to execute arbitrary code by influencing the code the product generates. While the attack requires authentication, the potential for code execution on affected systems is significant. The primary concern is confirming whether your organization utilizes the specified versions of IBM API Connect and assessing any potential exposure.

Authenticated attackers can run their own code.
Matters if API Connect manages external traffic.
Confirm relevance and verify affected systems.

Attack Path

How an attacker could exploit the issue

An attacker who has already logged into IBM API Connect could exploit this vulnerability by sending a specially crafted request. This request would manipulate how the product generates code, leading to the execution of arbitrary code on the system.

Attacker needs prior authentication.
Triggered by influencing generated code.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could potentially execute arbitrary code on IBM API Connect by manipulating user-supplied values that influence the generation of code. This could affect system data and service behavior when the product is configured to allow such manipulation.

System data and service behavior.
Attacker influences code generation.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Infrastructure and platform teams are most likely responsible for addressing this vulnerability in IBM API Connect, given its role in managing APIs, which often involves network-level configurations and underlying infrastructure. The first practical step is to identify all instances of the affected product, determine their exposure (internal vs. external, business criticality), and then assign ownership for remediation.

Infrastructure/platform teams own the issue.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect?

IBM API Connect is an enterprise-grade platform used to create, manage, secure, and monitor APIs across cloud and on-premises environments. It serves as a central hub for controlling how applications communicate, often acting as a gateway that facilitates traffic between external users and internal backend services.

What does CWE-94 mean for CVE-2026-17359?

CVE-2026-17359 is classified under CWE-94, which refers to the improper control of code generation. This means the software fails to properly sanitize user-supplied input, allowing an attacker to inject their own logic into the code the application generates. Consequently, the system inadvertently executes this attacker-controlled code, leading to unauthorized operations.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted request to the system while authenticated as a valid user. By manipulating certain input values, they influence the application's internal code generation process. Simply having access to the platform is not enough; the attacker must successfully supply input that alters the generation logic to execute unauthorized commands.

Is my IBM API Connect instance at risk?

Halo Surface Signal indicates that IBM API Connect is commonly deployed as an internet-facing gateway or portal to manage public API traffic. Because this software is frequently positioned at the network edge to handle external requests, it is more likely to be reachable by attackers compared to internal-only systems. You should prioritize assets that provide external connectivity.

What steps should I take if I use this software?

Start by identifying all instances of IBM API Connect within your environment, specifically focusing on versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Once mapped, assess which instances are accessible from the internet versus those on private networks. Finally, coordinate with your infrastructure or platform teams to track official vendor patches and manage the update process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.