Description
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
patch
https://www.ibm.com/support/pages/node/7278218
Vendor Advisory vendor-advisory
patch
https://www.ibm.com/support/pages/node/7278909
Scores
CVSS v3
9.1
EPSS
0.0051
EPSS Percentile
39.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (3)
IBM/API Connect
10.0.8.0 - 10.0.8.9
IBM/API Connect
12.0
ibm/api_connect
10.0.8.0 - 10.0.8.10
Published
Jul 08, 2026
Tracked Since
Jul 08, 2026