IBM API Connect CVE-2026-17342

Exploitation requires a valid authenticated session on the target IBM API Connect instance (CVSS PR:L indicates low-privileged authentication is needed, not an anonymous attacker), but no user interaction and no special network positioning (AV:N/UI:N). The affected deployments are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2; versions outside these ranges and patched instances are not affected. The limiting factor is the authentication requirement - an attacker must first obtain or be granted a low-privilege account - which reduces exposure for instances that tightly control account provisioning. The specific product feature, API, or configuration that performs the vulnerable code generation is not identified in the available sources, so the exact triggering surface cannot be named.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable exploitation of low complexity requiring only low-level privileges (PR:L = an authenticated but non-administrative user), with no user interaction and a scope change (S:C) yielding total confidentiality, integrity, and availability impact - consistent with CWE-94 code injection leading to arbitrary code execution. The vuln.today Decision label is act_now and IBM has shipped a patch, which together argue for prompt remediation. However, the exploitation signals are mixed and partly absent: no EPSS probability was provided, the CVE is not listed in CISA KEV in this input, and no PoC or exploit reference is present - so there is no evidence of active exploitation or public exploit code at this time. The prioritization therefore rests on the severe technical impact and low attack prerequisites (any authenticated account suffices) rather than on observed in-the-wild activity. The scope change (S:C) implies the vulnerable component can impact resources beyond its own security scope; the description does not detail the mechanism, so the exact privilege boundary crossed is not confirmed from available data.

A remote attacker who already holds a low-privileged authenticated account on an affected IBM API Connect instance (10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2) submits crafted input that the platform improperly incorporates into generated code, causing arbitrary code execution on the server. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N with a scope change, no victim interaction is needed and the impact can extend beyond the initial component. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS metrics and CWE-94 classification rather than from a demonstrated exploit.