IBM API Connect EUVD-2026-118782

Exploitation requires the attacker to hold valid authentication to the IBM API Connect instance at low privilege (CVSS PR:L) and network reachability to the affected component (AV:N); attack complexity is low (AC:L) and no user interaction is needed (UI:N). The vulnerable condition is that user-supplied input reaching an OS command path is not properly neutralized (CWE-78), allowing injected commands to run on the underlying host; the specific product feature, endpoint, or parameter that carries the injectable input is not described in the available sources. The principal LIMITING factor is the authentication requirement - an attacker needs an existing low-privilege account or a means to obtain one - which narrows the exposure relative to a fully unauthenticated flaw. Affected deployments are limited to IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes network-reachable, low-complexity exploitation by an attacker holding only low-level privileges (PR:L), with a scope change and full confidentiality, integrity, and availability impact - consistent with OS command injection (CWE-78) that executes on the underlying host from the application context. The vuln.today decision label is act_now, which signals the provider's framework treats this as needing immediate action, and a vendor patch is available, so remediation is actionable now. However, key exploitation-probability signals are MISSING from the input: no EPSS score is provided, so widespread-exploitation likelihood cannot be quantified; there is no CISA KEV entry, so there is no confirmation of active exploitation; and no PoC or exploit reference is supplied. The act_now label and the 9.9 severity therefore rest on intrinsic severity and the low barrier to exploitation (any authenticated user) rather than on observed in-the-wild activity. The one conflicting-to-note nuance: the flaw requires authentication (PR:L), which limits it to attackers who already have, or can obtain, a valid low-privilege account - a meaningful constraint that tempers the otherwise network-facing, low-complexity profile. Treat as a prompt-patch priority for any exposed API Connect deployment while recognizing that no active-exploitation evidence is present in the provided data.

A remote attacker who holds a valid low-privilege account on an affected IBM API Connect instance (10.0.8.0-10.0.8.12 or 12.1.0.0-12.1.1.2) submits input that is not properly neutralized before being passed to an operating-system call, injecting attacker-controlled commands that run on the underlying host. Because the CVSS vector is AV:N/AC:L, this is reachable over the network with low attack complexity once authenticated, and the scope change (S:C) reflects code execution escaping the application into the host OS. No public exploit code or PoC reference is provided in the available sources, so weaponization status is unknown.