IBM API Connect is affected by a stored cross‑site scripting vulnerability that arises when user‑supplied input is placed in a web page during an update without proper neutralization. An authenticated attacker can inject malicious JavaScript, which then runs in the browser of any user who later views that page, giving the attacker the same access level as the victim.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted. These versions are the on‑premises API Gateway and management portal components provided by IBM.

The CVSS score of 8.7 classifies this flaw as high severity. EPSS information is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. Because the flaw requires authentication to the API Connect instance and uses the page‑update function, an attacker must first obtain valid credentials. Once malicious JavaScript is stored, any subsequent user who loads the affected page experiences execution of that script in their browser, granting the attacker the same level of access as the victim and potentially compromising confidentiality, integrity, or availability of the system.