IBM API Connect EUVD-2026-118727

Exploitation requires valid authenticated access to IBM API Connect at a low privilege level (CVSS PR:L) - it is NOT unauthenticated. The attacker must reach the application over the network (AV:N) and supply input that is passed into a SQL command without proper neutralization; the exact feature, endpoint, or parameter that accepts the injectable input is not described in the available sources. Affected deployments are IBM API Connect versions 12.1.0.0 through 12.1.1.2. The primary limiting factor is the authentication requirement (a low-privileged account is a prerequisite); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The scope-changed rating (S:C) indicates impact can extend beyond the vulnerable component, e.g. to the backing database or adjacent resources.

This is a genuine high-priority issue, not merely an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) indicates network-reachable exploitation at low attack complexity requiring only low-level privileges (PR:L), with a scope change (S:C) driving the near-maximal score - a SQL injection that can impact resources beyond the vulnerable component's security authority, with high confidentiality, integrity, and availability impact. The vuln.today Decision label is act_now, consistent with the critical rating and vendor-confirmed patch availability. Key signals are MISSING and should temper automation-level urgency: no EPSS score is provided, so real-world exploitation probability cannot be quantified; KEV status is absent, so there is no confirmed active exploitation; and no POC or exploit reference appears in the input. The PR:L requirement means an attacker needs valid (if low-privileged) authenticated access to the API Connect instance, which limits opportunistic mass exploitation compared to a fully unauthenticated flaw. Net: treat as an urgent patch given act_now and the critical authenticated SQLi with scope change, while noting exploitation probability is unquantified due to missing EPSS/KEV/POC data.

A remote attacker who already holds low-privileged authenticated access to IBM API Connect (12.1.0.0 through 12.1.1.2) submits crafted input containing unneutralized SQL special characters, which the application incorporates into a SQL command. Because CVSS scope is changed (S:C), successful injection can read, modify, or destroy data and affect resources beyond the immediate component. No public exploit is identified at time of analysis, and the specific injectable parameter or feature is not described in the available sources.