The vulnerability in IBM API Connect enables a remote authenticated attacker to cause a denial of service and to read sensitive data via error messages. The flaw arises from insecure error handling that exposes internal data when producing error responses. Attackers who can authenticate against the API Connect instance may trigger specific endpoints that return detailed error logs containing configuration details or credentials, thereby compromising confidentiality. The impact is limited to systems where the attacker can log in, but the availability loss can affect critical integration points in an API gateway.

IBM API Connect 10.0.8.0 through 10.0.8.12 and IBM API Connect 12.1.0.0 through 12.1.1.2 are affected. The affected releases include 10.0.8.0, 10.0.8.1, up to 10.0.8.12, and 12.1.0.0 through 12.1.1.2. Vendors should verify whether their deployed instances fall within these ranges and plan to upgrade accordingly.

The CVSS score of 5.4 indicates moderate risk. Because the flaw requires authentication, the threat surface is constrained, but once an attacker has valid credentials they can easily trigger the error responses and either obtain sensitive information or interrupt service. EPSS is not available, indicating no publicly reported exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, attackers could use the disclosure to craft more advanced attacks, so administrators should treat this as a moderate to high priority patch.