IBM API Connect CVE-2026-9074

The specific prerequisite is that the target must expose IBM API Connect's password reset functionality (the account self-service/credential reset endpoint) reachable over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are required beyond the reset feature being enabled and network-accessible. The primary limiting factor is network exposure of the management/portal password reset endpoint - deployments that keep this interface on an isolated management network or behind restrictive ACLs are not remotely reachable by external attackers. Affected deployments are limited to versions 10.0.8.0-10.0.8.9 and 12.1.0.0-12.1.0.3 (and the 12.0 line per EUVD); other versions are not in scope.

The signals are partly divergent and warrant nuance. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates trivially reachable, unauthenticated, low-complexity network exploitation with total impact, and CISA SSVC corroborates this with Automatable:yes and Technical Impact:total - an ideal target for automation once an exploit is developed. However, EPSS is only 0.44% (35th percentile), and SSVC Exploitation status is 'none', meaning no observed exploitation and no public exploit yet identified; the vulnerability is not on CISA KEV. This is a classic high-severity-but-not-yet-exploited profile: the theoretical risk is severe and the automatable/unauthenticated nature means weaponization could be rapid, so it should be prioritized for prompt patching even though current in-the-wild activity is unconfirmed. No conflicting data was found between the CVSS network vector and the description, which explicitly states unauthenticated remote SQL injection.

A remote, unauthenticated attacker sends a crafted request to the API Connect password reset endpoint with malicious SQL embedded in an input field (such as the username or email parameter). Because the input is not sanitized before being used in a SQL query, the attacker extracts or modifies data in the credential store - for example dumping account records or altering reset tokens - potentially escalating to account takeover or full data compromise. No public proof-of-concept has been identified at time of analysis, but the low attack complexity and automatable nature make exploit development straightforward.