AI analysis
Claude Opus · 8 Nov 2026, 10:19 CET
IBM API Connect flaw lets authenticated users run commands on the host system
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a critical OS command injection flaw (CVSS 3.1: 9.9). Any low-privileged account could run commands on the host. Review IBM's advisories and patch promptly.
In plain terms
IBM API Connect is a platform organisations use to publish, secure and manage APIs, the interfaces that let applications exchange data. In the affected versions, some input supplied by users is passed to the server's operating system without being properly cleaned first. This is called command injection: an attacker hides operating system commands inside ordinary-looking input, and the server runs them.
The attacker needs a valid account, but according to the scoring only a low level of privilege is required. A successful attacker could take control of the server running API Connect. Organisations running the affected 10.0.8.x or 12.1.x releases, especially where many users or partners have accounts, should treat this as urgent.