CVE-2026-9074

EUVD-2026-42307
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20.75%
Affected Products (NVD)
VendorProductVersion
ibmapi_connect
10.0.8.0 ≤
𝑥
< 10.0.8.10
ibmapi_connect
12.1.0.0 ≤
𝑥
< 12.1.1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.ibm.com/support/pages/node/7278218
https://www.ibm.com/support/pages/node/7278909