The vulnerability is a Server Side Request Forgery (CWE‑918) that permits a remote attacker to craft requests performed by the IBM API Connect server against arbitrary internal network addresses, enabling access to internal resources that were not exposed externally. The impact is that sensitive data, internal services, or configuration endpoints could be read or manipulated, potentially leading to data exposure or further lateral movement within the organization.

Affected systems are IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Any installation of these releases that is exposed to external networks is vulnerable. The vendor recommends upgrading to 12.1.1.3 or 10.0.8.13 where the issue has been fixed.

The CVSS score for this vulnerability is 9.3, indicating a high severity. EPSS is not available, but the lack of KEV listing does not diminish the threat of exploitation, especially when the application is publicly accessible. The likely attack vector is through the API endpoints that are reachable over the internet; an attacker does not need authentication unless the API requires it, and the SSRF can bypass authentication by calling internal services. Given its remote nature and high impact, organizations should prioritize remediation.