IBM API Connect 10.0.8.0 through 10.0.8-12 and 12.1.0.0 through 12.1.1.2 contains a flaw that permits code to be generated and executed by the management service in non‑default configurations. The vulnerability arises from improper control of code generation, allowing customization content to be interpreted as executable code. The impact is the ability for an attacker to run arbitrary code on the affected system.

Affected products include IBM API Connect for the 10.0.8 line (10.0.8.0–10.0.8.12) and the 12.1 line (12.1.0.0–12.1.1.2). IBM recommends upgrading to 12.1.1.3 for the 12.1 series or to 10.0.8.13 for the 10.0.8 series. The vulnerability is tied to features that are not enabled by default, but may be enabled in certain deployment configurations.

The CVSS score of 7.5 classifies this flaw as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likelihood of exploitation depends on the presence of the affected management service and whether the vulnerable configuration is active. Attackers would need network access to the management interface and would target systems where dynamic code generation is enabled and not properly restricted.