Multiple vulnerabilities have been identified in IBM API Connect and Aspera Faspex. These flaws pose a severe risk to organizations by enabling remote code execution, authentication bypass, and unauthorized administrative control. The overall risk is critical, as many of these issues allow attackers to compromise gateway settings and tenant data without prior authentication.
CVE-2026-17402 (CVSS 9.9 — Critical): An OS command injection vulnerability in IBM API Connect allows authenticated remote attackers to execute arbitrary system commands on the affected server because user-supplied input is not properly neutralized before being passed to the operating system, potentially resulting in full system compromise.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in IBM API Connect and Aspera Faspex. These flaws pose a severe risk to organizations by enabling remote code execution, authentication bypass, and unauthorized administrative control. The overall risk is critical, as many of these issues allow attackers to compromise gateway settings and tenant data without prior authentication.
CVE-2026-17402 (CVSS 9.9 — Critical): An OS command injection vulnerability in IBM API Connect allows authenticated remote attackers to execute arbitrary system commands on the affected server because user-supplied input is not properly neutralized before being passed to the operating system, potentially resulting in full system compromise.[emaillocker id="1283"]
CVE-2026-17392 (CVSS 9.9 — Critical): This is an LDAP Injection vulnerability that enables an authenticated attacker to gain administrative access to other tenants. The flaw allows malicious input to manipulate LDAP queries and bypass intended access controls.
CVE-2026-17410 (CVSS 9.9 — Critical): This Argument Injection vulnerability permits an authenticated user to access and modify other tenants’ portal data. The flaw allows the manipulation of arguments to bypass tenant isolation boundaries.
CVE-2026-17301 (CVSS 9.8 — Critical): This Improper Verification of Cryptographic Signature flaw allows an unauthenticated attacker to bypass authentication. The failure to properly validate cryptographic signatures enables unauthorized access to protected resources.
CVE-2026-17408 (CVSS 9.8 — Critical): An OS command injection vulnerability in IBM API Connect allows remote attackers to execute arbitrary code due to improper neutralization of special elements in OS commands.
CVE-2026-17360 (CVSS 9.8 — Critical): This Use of Hard-coded Credentials vulnerability grants full administrative control to an unauthenticated attacker. The presence of static credentials in the application allows bypassing standard authentication mechanisms.
CVE-2026-17340 (CVSS 9.8 — Critical): This Path Traversal flaw allows an unauthenticated attacker to access arbitrary files on the system. The improper handling of file paths enables reading or writing sensitive data outside the intended directory.
CVE-2026-17313 (CVSS 9.8 — Critical): This Authentication Bypass Using an Alternate Path or Channel vulnerability allows an unauthenticated attacker to take control of gateway configuration. The flaw provides an alternative route to access administrative functions without proper credentials.
CVE-2026-123218 (CVSS 9.8 — Critical): This vulnerability affects IBM Aspera Faspex and allows a user to craft a message to gain full administrative privileges. The flaw enables privilege escalation through specific message manipulation.
The following reports contain further technical details:
[/emaillocker]