RCE in IBM API Connect
CVE-2026-105002
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- www.ibm.com/support/pages/node/7295635 (vendor-advisory, patch)
- www.ibm.com/support/pages/node/7295637 (vendor-advisory, patch)
Frequently asked questions
- What is CVE-2026-105002?
- CVE-2026-105002 is a high-severity vulnerability in IBM API Connect, classified under Code Injection. CVSS score: 7.5/10. Published 2026-11-07.
- How severe is CVE-2026-105002?
- High severity. CVSS v3 base score is 7.5 out of 10.