IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrativ…
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
▸ Remotely exploitable over the network — no physical or local access required
▸ Low attack complexity — no special conditions needed to exploit
▸ No authentication required
▸ No user interaction needed — can be exploited automatically
Apply the vendor patch as soon as it's available or already released.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
Wiz vulnerability database ( if an entry exists )
External links to independent research; content is theirs and is not reproduced here.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
