IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML external entity injection flaw (CWE‑611) that allows a remote attacker to trigger the parser to read arbitrary files or network resources, thereby exposing configuration data, credentials, or other sensitive information. This weakness represents a critical information disclosure issue.

The affected systems are IBM API Connect products deployed at version 12.1.0.0 and 12.1.1.2. All customers using these releases without the recommended update are potentially exposed to XXE exploitation.

The CVSS score of 9.9 categorizes this vulnerability as critical. Although the EPSS score is not available, the flaw remains highly concerning and the KEV catalog does not list it. The attack vector is likely remote, requiring only the ability to send crafted XML requests to any reachable API service; once exploited, an attacker can read sensitive data.