IBM API Connect EUVD-2026-118632

Exploitation requires a valid authenticated account on the affected IBM API Connect instance (CVSS PR:L), network reachability to the service (AV:N), and no user interaction (UI:N) at low attack complexity (AC:L). The concrete prerequisite is the ability to submit a request that sets an object attribute which should be controlled only by the system - a CWE-915 mass-assignment condition - but the available sources do not identify the exact feature, endpoint, parameter, or configuration that exposes it. Affected deployments are limited to versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2; the primary limiting factor is the authentication requirement, so risk is highest where low-privilege accounts (e.g. developer/self-service portal users) are broadly granted. Updating to the IBM-patched release is the remediation indicated by the evidence.

This is a genuine high-priority issue, not a CVSS-inflated one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction, with a scope change and total confidentiality/integrity/availability impact - consistent with the description's claim of arbitrary code execution via CWE-915 (improperly controlled modification of object attributes, i.e. mass-assignment of a system-controlled field). The vendor-assigned priority is act_now, and a patch is already available, which together argue for urgent remediation. However, several widely-used exploitation signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no PoC/exploit reference provided. Per the precision rules this is therefore 'no public exploit identified at time of analysis' - the 9.9 reflects potential severity and the vendor's act_now decision, not observed in-the-wild activity. The main uncertainty is mechanism: the description says a user can set a field that should only be system-controlled, but the exact feature, endpoint, or attribute is not identified, and the trigger is not described in the available sources. The PR:L rating means a valid (low-privilege) account is required, which meaningfully limits exposure versus a fully unauthenticated flaw but does not remove it, especially where API Connect self-service or developer-portal accounts are broadly provisioned.

A remote attacker holding a low-privileged authenticated account on IBM API Connect submits a crafted request that includes an extra object attribute which should only be set by the system; because the attribute modification is improperly controlled, the attacker overwrites it and drives the application into executing attacker-chosen code. No user interaction is needed and attack complexity is low. No public exploit or PoC reference is provided in the input, and the precise triggering request is not described in the available sources.