CVE-2026-105002

HighCVSS 7.5/10Last modified Nov 11, 2026

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
IBMAPI Connect>= 12.1.0.0, <= 12.1.1.2; >= 10.0.8.0, <= 10.0.8.12

References

Timeline

Published
Nov 7, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1050037.8Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.CVE-2026-1050047.8Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.CVE-2026-1050058.1Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.CVE-2026-1050066.4Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1050078.8An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length CVE-2026-1050089.0No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1050097.5Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-1050109.8Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1050137.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-1050149.1Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to exCVE-2026-1050169.8Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.CVE-2026-1050177.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authoriz
CVE-2026-105002: High severity, CVSS 7.5 | Vulnix