What is the CVSS score of CVE-2026-9074?

CVE-2026-9074 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM API Connect are affected by CVE-2026-9074?

IBM API Connect versions 10.0.8.0-10.0.8.9 and 12.1.0.0-12.1.0.3 contain a critical unauthenticated SQL injection in the password reset function, allowing remote attackers to fully compromise the API…. A patch is available.

How to fix or mitigate CVE-2026-9074?

Within 24 hours: identify and document all systems running IBM API Connect 10.0.8.0-10.0.8.9 or 12.1.0.0-12.1.0.3; restrict network access to affected instances from untrusted sources. Within 7 days: apply vendor-released patch from IBM (consult IBM advisory for exact fixed versions for your release branch). Within 30 days: audit database access logs for unauthorized activity and rotate all stored API credentials and authentication tokens.

IBM API Connect CVE-2026-9074

EUVD-2026-42307 CRITICAL

SQL Injection (CWE-89)

2026-07-08 ibm

GHSA-hw2j-c5q4-7m9c

IBM SQLi Api Connect

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, network-reachable password reset endpoint with low-complexity SQL injection yields PR:N/AC:L/AV:N; SQLi over the credential store gives full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 17:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 10, 2026 - 17:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 17:07 vuln.today

cvss_changed

CVSS changed

Jul 10, 2026 - 17:07 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jul 08, 2026 - 16:25 vuln.today

DescriptionNVD

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

AnalysisAI

Unauthenticated SQL injection in IBM API Connect's password reset functionality allows remote attackers to inject arbitrary SQL against the backing database without credentials, affecting versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3. With a CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) and total technical impact, exploitation can lead to full compromise of confidentiality, integrity, and availability of the API management data store. No public exploit identified at time of analysis, and EPSS remains low (0.44%), but IBM has released patches and CISA's SSVC flags the flaw as automatable with total impact.

Technical ContextAI

IBM API Connect is an enterprise API lifecycle management platform used to create, secure, socialize, and monetize APIs, typically deployed as a gateway/management fabric in front of backend services. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input in the password reset flow is concatenated into a SQL query without proper parameterization or sanitization. Because the password reset endpoint is reachable pre-authentication, an attacker can manipulate query logic in the identity/credential store that API Connect uses to manage user accounts. The affected CPE is cpe:2.3:a:ibm:api_connect, spanning the 10.0.8.x and 12.1.0.x/12.0 release lines.

RemediationAI

Patch available per vendor advisory: apply the fixes referenced in IBM's support bulletins at https://www.ibm.com/support/pages/node/7278909 and https://www.ibm.com/support/pages/node/7278218, upgrading beyond the affected 10.0.8.x and 12.1.0.0-12.1.0.3 ranges to the IBM-designated fixed level (confirm the exact target build in those advisories, as an explicit fixed version string was not provided in the input). If immediate patching is not possible, apply compensating controls: restrict network access to the API Connect management/portal interfaces and specifically the password reset endpoint using network ACLs or a reverse proxy/WAF so only trusted management networks can reach it (trade-off: legitimate self-service password reset for external users will break), and deploy WAF signatures to detect and block SQL injection patterns on the reset request parameters (trade-off: signature-based filtering can be bypassed and is not a substitute for the patch). Monitor database and application logs for anomalous SQL errors or reset requests as an interim detective control.