AI analysis
Claude Opus · 8 Nov 2026, 10:20 CET
IBM API Connect flaw lets authenticated users execute arbitrary code
IBM API Connect 10.0.8.0–10.0.8.12 and 12.1.0.0–12.1.1.2 contain a code injection flaw (CVSS 3.1: 9.9) that lets any low-privileged authenticated user run arbitrary code. Review IBM's linked support pages and apply the vendor's remediation promptly.
In plain terms
IBM API Connect is a platform organisations use to publish, secure and manage APIs, the interfaces that let applications talk to each other. In certain versions, the software does not properly control how it builds and runs code. A user who has any valid login could abuse this to make the system run commands of their choosing.
This matters to any organisation running the affected versions, especially where many developers, partners or customers hold accounts. Because API Connect often sits in front of important business systems, a takeover of it could expose data and connected services well beyond the platform itself.
Technical analysis
The weakness is classified as CWE-94, improper control of generation of code, also called code injection. The flaw arises when input influences code that the application generates and then executes, without sufficient validation or neutralisation. The record does not identify the specific component, endpoint or code path in API Connect where this occurs.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The attack is possible over the network with low complexity. It needs only low-level privileges, meaning an ordinary authenticated account, and requires no user interaction. The scope is changed, so successful exploitation can affect resources beyond the vulnerable component itself, for example the underlying host or connected services. Confidentiality, integrity and availability impacts are all rated high.