IBM API Connect EUVD-2026-118636

Requires a valid authenticated session on IBM API Connect at low privilege (CVSS PR:L) - exploitation is not anonymous/unauthenticated. The affected product must be a running instance in the 12.1.0.0 through 12.1.1.2 version range; versions with the vendor patch applied are not affected. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the attacker can trigger the flaw directly over the network. The specific feature, endpoint, or parameter carrying the unneutralized input is not described in the available sources, so the only confirmed limiting factors are the authentication requirement and the affected version range.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) indicates a remotely reachable, low-complexity SQL injection requiring only low-level authenticated privileges and no user interaction, with a scope change and high confidentiality, integrity, and availability impact - the scope change reflects that SQLi can reach backend data and systems beyond the application's own authorization boundary. The vendor-assigned priority is act_now and a patch is available, which together argue for prompt remediation. However, several key exploitation signals are MISSING and must not be presented as present: there is no EPSS probability in the input, no CISA KEV listing, and no public PoC reference, so exploitation status is 'no public exploit identified at time of analysis.' The one tempering factor is that exploitation requires valid authenticated access (PR:L), so the realistic threat is an authenticated/low-privileged user or an attacker who has already obtained credentials - not a fully anonymous internet attacker. Net: treat as urgent patching per the act_now label, while recognizing that the absence of KEV/EPSS/PoC data means active-exploitation likelihood is unquantified rather than confirmed low or high.

A remote attacker holding low-privilege authenticated access to an IBM API Connect instance (12.1.0.0 through 12.1.1.2) submits input containing unneutralized special characters into an affected parameter, which is concatenated into a backend SQL statement. Because privileges required are low and attack complexity is low, the attacker can read, modify, or destroy database contents and potentially pivot to connected systems (scope change). No public exploit code is identified at time of analysis, so this reflects the CVSS-described mechanism rather than a demonstrated weaponized exploit.