IBM API Connect EUVD-2026-118773

Exploitation requires the attacker to already hold a valid authenticated account on the IBM API Connect instance (CVSS PR:L) and requires that the deployment uses an LDAP-backed directory for user/tenant resolution, since the flaw is improper neutralization of user-supplied input in LDAP directory queries (CWE-90). The highest-impact realistic condition is a MULTI-TENANT deployment, because the described outcome is crossing from the attacker's own tenant to administrative access over OTHER tenants; a single-tenant deployment lacks the cross-tenant boundary the attack abuses. Limiting factors: a low-privilege but legitimate account is needed (not remote-unauthenticated), no user interaction is required, and only the listed versions (10.0.8.0-10.0.8.12, 12.1.0.0-12.1.1.2) are affected. The exact injectable input field/endpoint is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity attack that needs only low privileges - any valid tenant-level account - and achieves a scope change with full confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with the 9.9 score and the description's cross-tenant administrative compromise via LDAP injection (CWE-90). The vuln.today decision label is 'act_now' and IBM has shipped a patch, which together argue for prompt remediation. However, key exploitation signals are MISSING: no EPSS probability is supplied, there is no CISA KEV listing, and no POC or exploit reference is present, so per the data there is no public exploit identified at time of analysis - the urgency here rests on the 'act_now' decision label, the critical CVSS, and the low barrier (authenticated-but-low-privilege, no user interaction), not on confirmed in-the-wild activity. The one tension worth flagging: the attack requires an existing authenticated tenant account (PR:L), so despite the critical score this is not remote-unauthenticated; realistic risk is highest in multi-tenant deployments where low-trust tenant accounts exist. Absence of EPSS/KEV should be read as 'unknown/not-yet-tracked,' not as evidence of low risk.

A remote attacker holding a legitimate low-privilege account on one tenant of a multi-tenant IBM API Connect deployment submits crafted input that is passed unsanitized into an LDAP directory query. By injecting LDAP filter syntax, the attacker alters the query so it resolves against other tenants, granting unauthorized administrative access across tenant boundaries. No public exploit identified at time of analysis, and no user interaction is required.