CVE-2026-9074
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.
Risk Assessment
An unauthenticated attacker can exploit this vulnerability to manipulate the database, potentially leading to unauthorized data access or account takeover.
Recommendation
Immediately upgrade IBM API Connect to a patched version and restrict access to the password reset functionality to trusted networks only.
Other vulnerabilities in IBM API Connect
See all- CVE-2017-1322High
IBM API Connect version 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2017-1379High
IBM API Connect version 5.0.0.0 could allow a remote attacker to obtain sensitive information due to improper handling of requests to the Developer Portal.
- CVE-2017-1161High
IBM API Connect version 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. An attacker could exploit this vulnerability by crafting a malicious URL.
- CVE-2025-13915Critical
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
- CVE-2026-3144High
IBM API Connect versions 12.1.0.0 through 12.1.0.3 use default credentials, which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.
Original NVD description (English source)
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.