IBM API Connect CVE-2025-13915

No special conditions stated - the description and CVSS vector (AV:N/AC:L/PR:N/UI:N) indicate remote unauthenticated exploitation of IBM API Connect against default reachable deployments. The primary limiting factor is version scope: only IBM API Connect 10.0.8.0 through 10.0.8.5 and 10.0.11.0 are listed as affected, so instances outside these versions are not exposed to this specific flaw. Network reachability to the API Connect management/gateway interface is the practical prerequisite; the description names no feature toggle, non-default setting, or deployment mode required to trigger the bypass.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) describes a network-reachable, low-complexity, unauthenticated authentication bypass with full confidentiality, integrity, and availability impact on IBM API Connect - the worst-case profile for a severity score. The CWE-305 classification and 'Authentication Bypass' tag are consistent with the description, so the vulnerability class itself is coherent and not a case of inflated CVSS. However, the real-world-risk signals that normally sharpen prioritization are entirely absent from the input: no EPSS exploitation-probability score is provided, the vulnerability is not indicated as being on the CISA KEV list, and no proof-of-concept is referenced (the single reference is the IBM vendor advisory node 7255149). Per the precision rules this means 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied either. Net assessment: this is a genuine high-priority patch candidate because an unauthenticated auth bypass on an internet-facing API gateway is exactly the kind of flaw that gets weaponized quickly, but the absence of EPSS/KEV/POC evidence means active exploitation cannot be claimed - treat it as high-urgency-by-nature rather than high-urgency-by-confirmed-exploitation. No conflicting signals were found between the CVSS vector and the description; both agree on remote unauthenticated access.

A remote attacker with network reach to an exposed IBM API Connect instance (versions 10.0.8.0-10.0.8.5 or 10.0.11.0) sends requests that bypass the authentication layer, obtaining unauthorized access to the application without valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed. No public exploit code is identified at time of analysis, so exploitation would require the attacker to independently develop the bypass technique.