IBM API Connect CVE-2026-17354

Exploitation requires a remote attacker to be authenticated to IBM API Connect with at least low-level privileges (PR:L) - it is not an unauthenticated flaw, which is the primary limiting factor and means credentials or an account on the target instance are a prerequisite. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attacker needs no special timing or victim action. Affected deployments are limited to versions 12.1.0.0 through 12.1.1.2; the available sources do not name the specific endpoint, API feature, or configuration mode that exposes the path-traversal write, so the exact vulnerable component is not described in the input. The vendor patch (IBM support node 7295635) is the stated remediation.

This is a genuine high priority, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity path-traversal file write that requires only low-privilege authentication and no user interaction, with a scope change reflecting that arbitrary file writes can affect resources beyond the application's own security boundary (e.g. the host filesystem). The vuln.today decision label is act_now and a vendor patch is already available, both of which argue for prompt remediation. The 9.9 score is driven largely by the scope change plus full C/I/A impact; note that the description itself only explicitly states 'arbitrary file writes' (an integrity primitive), so the high confidentiality and availability ratings are consequential inferences (file write frequently escalates to code execution) rather than facts stated in the source. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided in the input, so there is currently no public exploit identified at time of analysis and no probabilistic exploitation signal to weigh - the urgency rests on the vendor-assigned severity, the act_now decision label, and the reachability of the flaw, not on observed exploitation.

A remote attacker holding low-privilege authenticated access to an IBM API Connect instance (12.1.0.0 through 12.1.1.2) sends a crafted request whose file path contains traversal sequences, causing the application to write attacker-controlled content outside its intended directory. Because the write can land on sensitive host locations, it can be leveraged to overwrite configuration or deploy executable content, potentially leading to code execution. No public exploit identified at time of analysis, and no user interaction is required.