IBM API Connect CVE-2026-3144

Exploitation requires that the target IBM API Connect instance (versions 12.1.0.0 through 12.1.0.3) is still using its shipped default credentials - that is, the attacker must reach the instance during the window after deployment and before the system enforces the mandatory credential update, and the management/login interface must be network-reachable. What LIMITS exploitation: once an administrator completes the forced credential change the default credentials no longer work, so properly initialized instances that promptly changed defaults are not exploitable; effectiveness therefore depends on catching un-initialized or newly provisioned instances and on those instances being network-accessible from the attacker's position.

The signals are mixed. CVSS 3.1 rates this 9.8 (AV:N/AC:L/PR:N/UI:N, total C/I/A impact) reflecting that a network-reachable instance can be fully compromised with a known credential and no user interaction. SSVC counters this with Exploitation: none and Automatable: no, and EPSS is low at 0.37% (29th percentile), indicating no evidence of active or automated exploitation in the wild. Technical Impact is rated total, consistent with the CVSS impact metrics. The vulnerability is not on CISA KEV and no POC is known. The practical risk is bounded by a real limiting factor embedded in the description: exploitation only works during the interval before the credential update is enforced, so hardened, properly initialized deployments that promptly changed defaults are not exposed. Net assessment: high theoretical severity for newly stood-up or un-initialized instances, but lower real-world urgency than the raw 9.8 suggests given no exploitation evidence and the narrow default-credential window.

An attacker who can reach the network-exposed management interface of a freshly deployed IBM API Connect 12.1.x instance authenticates using the product's documented default credentials before the operator completes the enforced credential update. With that access the attacker gains full control over API definitions, secrets, and gateway configuration. No public exploit code is required beyond knowledge of the default credentials, and the low attack complexity (AC:L) means no special timing or evasion is needed beyond catching the instance pre-initialization.