IBM API Connect EUVD-2026-118744

Exploitation requires a valid low-privileged authenticated account on an affected IBM API Connect instance (CVSS PR:L), after which the attacker supplies a value that influences code the product generates (CWE-94), leading to code execution. The affected deployments are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Limiting factors: authentication is required (not anonymous), so the attacker must already possess or obtain credentials; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, API, or configuration that exposes the vulnerable code-generation path is not described in the available sources, so it cannot be confirmed whether a non-default configuration is required.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes network-reachable, low-complexity exploitation requiring only low-level authentication, no user interaction, with a scope change and full confidentiality/integrity/availability impact - consistent with the CWE-94 'improper control of generation of code' mechanism leading to arbitrary code execution. The vuln.today Decision label is 'act_now' and a vendor patch is available, which raises urgency. However, several key exploitation signals are MISSING from the input: there is no EPSS probability provided, no CISA KEV listing, and no PoC or exploit reference. By the precision rules this means 'no public exploit identified at time of analysis' - so while severity and exploitability metrics are severe, there is no evidence of active or public exploitation yet. The one notable tension: the vulnerability is remotely reachable but gated by PR:L (authentication required), so real-world risk concentrates on environments where an attacker can obtain or abuse a low-privilege API Connect account; it is not anonymous internet-wide RCE. Net: treat as act_now for patching given a credentialed-RCE on an enterprise gateway with scope change, while recognizing exploitation is currently theoretical/unpublished rather than observed.

A remote attacker holding low-privileged credentials to an IBM API Connect instance (versions 10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2) submits a user-supplied value that influences code the product generates, causing that attacker-controlled input to be executed as code on the system. Because the CVSS scope is changed (S:C), the resulting code execution can affect components beyond the initially vulnerable one. No public exploit identified at time of analysis, and the exact injection trigger is not described in the available sources.