The vulnerability is a server‐side request forgery (CWE‑918) that allows a remote authenticated attacker to cause API Connect to make unauthorized HTTP requests to internal resources, enabling the attacker to read sensitive data. Because exploitation requires valid credentials, the impact is limited to accounts with sufficient permissions, but still poses a risk of leaking confidential information or internal system details.

Affected versions of IBM API Connect include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. IBM recommends addressing the issue immediately by upgrading to 10.0.8.13 or 12.1.1.3, which contain fixes for the SSRF flaw.

The CVSS score of 8.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation remains uncertain, but the requirement for remote authenticated access suggests the attacker must first compromise credentials. The likely attack vector is through the API Connect management console or REST API, where an authenticated user can trigger the server‑side request. The attacker can exploit the flaw to access internal services or data that would normally be protected.