CVE-2026-9074

CriticalCVSS 9.1

Published: 08/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

35th percentile - higher than 35% of all known CVEs

Summary

IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

Risk Assessment

An unauthenticated attacker can exploit this vulnerability to manipulate the database, potentially leading to unauthorized data access or account takeover.

Recommendation

Immediately upgrade IBM API Connect to a patched version and restrict access to the password reset functionality to trusted networks only.

Original NVD description (English source)

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.