What is the CVSS score of CVE-2026-3144?

CVE-2026-3144 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM API Connect are affected by CVE-2026-3144?

IBM API Connect versions 12.1.0.0 through 12.1.0.3 contain a default-credential authentication bypass allowing remote, unauthenticated attackers full platform access, exposing all managed APIs and…. A patch is available.

How to fix or mitigate CVE-2026-3144?

WITHIN 24 HOURS: Identify and inventory all IBM API Connect 12.1.0.0-12.1.0.3 deployments; restrict network access to administrative interfaces to authorized networks only; isolate any freshly deployed instances pending hardening. WITHIN 7 DAYS: Apply vendor-released patch per IBM security advisory; force immediate credential rotation on all default accounts; audit platform audit logs for unauthorized API modifications or console access. WITHIN 30 DAYS: Conduct forensic review of authentication logs covering the vulnerable exposure window for exploitation evidence; re-audit all API credentials and secrets in production; validate dependent application connectivity and API functionality.

IBM API Connect CVE-2026-3144

EUVD-2026-42304 CRITICAL

Use of Default Credentials (CWE-1392)

2026-07-08 ibm

GHSA-m242-fcx4-2h8f

Authentication Bypass IBM Api Connect

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Default credentials are publicly known so authentication is effectively bypassed (PR:N); network-reachable with no user interaction and low complexity, yielding total compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 17:14 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 10, 2026 - 17:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 17:07 vuln.today

cvss_changed

Severity Changed

Jul 10, 2026 - 17:07 NVD

HIGH CRITICAL

CVSS changed

Jul 10, 2026 - 17:07 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 08, 2026 - 16:21 vuln.today

DescriptionNVD

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

AnalysisAI

Authentication bypass via default credentials in IBM API Connect 12.1.0.0 through 12.1.0.3 lets remote unauthenticated attackers log in with vendor-shipped default credentials during the window before the system forces a credential change on first use. Rated CVSS 9.8 with total confidentiality, integrity, and availability impact, the flaw grants full access to the API management platform. There is no public exploit identified at time of analysis and SSVC reports no observed exploitation, but the low attack complexity and known-credential nature make opportunistic abuse of freshly deployed instances plausible.

Technical ContextAI

IBM API Connect is an enterprise API lifecycle management and gateway platform used to create, secure, and publish APIs. The root cause is classified as CWE-1392 (Use of Default Credentials): the product ships with pre-set, well-known credentials that remain valid until an administrator completes an initial credential-update step. Because these defaults are documented and identical across installations, any party who can reach the management interface over the network can authenticate before the mandatory change is enforced. The affected component is identified by CPE cpe:2.3:a:ibm:api_connect covering versions 12.1.0.0 up to (not including) 12.1.0.3.

RemediationAI

Apply the vendor-released patch available per IBM's advisory at https://www.ibm.com/support/pages/node/7278909 and upgrade beyond the affected range to a fixed release (the EUVD range indicates 12.1.0.3 as the boundary; confirm the exact fixed build in the IBM advisory). As an immediate compensating control on any instance still running an affected version, force a change of all default and administrative credentials to strong unique values before or immediately upon deployment rather than relying on the delayed enforcement, and restrict network access to the management and administrative interfaces to trusted management networks via firewall or VPN so an un-initialized instance cannot be reached from untrusted networks during its first-boot window. The trade-off of network restriction is reduced administrative convenience and the need to allowlist legitimate management hosts. After remediation, verify no instances remain in a default-credential state.