Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-11-07T05:18:25.647Z",
  "pubdate": "2026-11-07T05:18:25.647Z",
  "executiveSummary": "IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the improper control of object attribute modification.\nThis vulnerability allows a remote, authenticated attacker to execute arbitrary code within the context of the application by manipulating system-restricted fields.\nThe flaw stems from insufficient input validation or object property sanitization, which permits an attacker to inject data that modifies internal system state or object logic.\nThe primary risk is a total compromise of the affected component, potentially leading to unauthorized data access, administrative control, or further escalation within the infrastructure.\nSuccessful exploitation requires the attacker to have established authenticated access to the system. Once authenticated, the attacker can leverage the ability to overwrite or define object attributes to force the underlying application framework to execute malicious commands or payloads.\nGiven the nature of API management platforms, this vulnerability poses a high-risk security threat, necessitating prompt remediation.",
  "technicalDetails": "The vulnerability is identified as an improper control of object attribute modification, which creates a vector for arbitrary code execution in IBM API Connect.\nThe root cause is a failure in the application's object model implementation, specifically where user-supplied input is insufficiently sanitized before being used to populate or modify object properties that should be restricted to system-level processes or internal application logic.\nIn environments where user inputs are bound directly to object models, an attacker may exploit this by performing an object injection or attribute pollution attack. By supplying malicious or unexpected values to fields that are typically reserved for system configuration or internal operations, the attacker influences the execution flow of the application.\nThe attack flow proceeds as follows: First, the attacker authenticates to the API Connect management interface or exposed management APIs. Second, the attacker identifies a request parameter or object attribute that is not properly restricted on the backend. Third, the attacker transmits a crafted request containing the unauthorized object attribute modification. Finally, the application processes the tainted object, leading to the execution of arbitrary code defined or enabled by the manipulated attributes.\nThe vulnerable component involves the handling of internal data structures where user-controlled attributes overlap with system-controlled attributes. When the application logic deserializes or initializes these objects, the modified attributes take precedence, allowing the attacker to alter the behavior of function calls, library loading, or command execution paths.\nBecause the attacker is modifying attributes that control application behavior, the payload behavior is often designed to bypass existing security controls or to execute system-level commands with the privileges of the API Connect service account. This allows for lateral movement or persistence within the environment.\nThe vulnerability affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It is strictly limited to remote authenticated attackers, meaning unauthorized users cannot exploit this without prior access credentials. However, for a user with legitimate but limited access, this flaw enables a significant vertical privilege escalation to arbitrary code execution."
}