CVE-2026-105002: Multiple Vulnerabilities in IBM API Connect

Published Nov 7, 2026

Updated

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 10.0.8.13
Upgrade
Upgrade IBM API Connect to a version that resolves this vulnerability.
Fixed in 12.1.1.3

Event History

Nov 7, 2026

CVE Published

via MITRE·04:31 AM

Data Sourced

via MITRE·04:31 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only IBM API Connect deployments in the affected version ranges that use the related customization feature in a non-default configuration are exposed. The feature must be enabled and insufficiently restricted; default configurations are not described as affected.

What must an attacker be able to do to exploit it?

An attacker would need a way to supply or influence customization content that the management service evaluates as code. Exploitation depends on the customization capability being enabled and its content controls not being properly restricted.

What can be done if updates cannot be applied immediately?

Review the customization feature configuration and disable it if it is not required. If it must remain enabled, restrict who can provide customization content and ensure that such content cannot be evaluated as untrusted code.

CVE-2026-105002: Multiple Vulnerabilities in IBM API Connect

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What can be done if updates cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to exploit it?

What can be done if updates cannot be applied immediately?