IBM API Connect CVE-2026-17150

Exploitation requires an authenticated account on an IBM API Connect instance (PR:L) and the ability to upload custom module content, which is then processed without sufficient input validation (CWE-184). The attack is most meaningful in multi-tenant deployments, since the described impact is crossing the tenant boundary (reflected by CVSS scope change S:C) to run code and read other tenants' data; in a single-tenant deployment the cross-tenant impact does not apply. Limiting factors: the attacker must already possess valid (even low-privilege) credentials and access to the custom-module upload feature, and only the listed versions (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2) are affected. No user interaction by a victim is required (UI:N). The precise mechanism by which validation is bypassed is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw needing only low privileges (any legitimate tenant account), with a scope change that lets impact cross from the attacker's tenant into others - fully consistent with the description's cross-tenant code execution and data access. The vuln.today decision label is act_now and IBM has shipped a patch, which together argue for prompt remediation. However, key corroborating signals are absent: there is no EPSS score, no CISA KEV listing, and no public PoC or exploit reference in the provided data, so exploitation status is: no public exploit identified at time of analysis. The strongest limiting factor is PR:L - an attacker must first hold a valid (even low-privilege) tenant account, so this is most relevant to multi-tenant deployments where tenant isolation is the security boundary; in such environments the scope change makes it severe because one tenant can reach others. No conflicts exist between the vector and the description; the main uncertainty is real-world exploitation likelihood, which cannot be quantified without EPSS/KEV data.

A low-privileged user of one tenant on a shared IBM API Connect deployment uploads crafted custom module content that bypasses input validation, causing attacker-controlled code to run with access beyond their own tenant and to read other tenants' sensitive data. Because the CVSS vector is AV:N/AC:L/PR:L with a scope change, exploitation is remote and low-complexity but requires an authenticated account. No public exploit code is identified in the available data.