AI analysis
Claude Opus · 8 Nov 2026, 10:20 CET
IBM API Connect flaw lets authenticated users run arbitrary code via code generation
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical code injection flaw (CVSS 3.1 score 9.9). Any low-privileged authenticated user could run code. Review IBM's advisories and restrict access promptly.
In plain terms
IBM API Connect is a platform organisations use to publish, secure and manage their APIs, the interfaces that let software systems talk to each other. Certain versions contain a flaw where information supplied by a user can shape program code that the product generates on its own. This is called code injection, meaning an attacker slips their own instructions into code the system then runs.
An attacker would need a valid account, but only one with low privileges. With that, they could make the system run commands of their choosing. Organisations running API Connect, especially where many developers, partners or tenants have accounts, should treat this as a priority.