IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a flaw that permits a remote authenticated attacker to inject arbitrary SQL commands because the system does not properly neutralize special elements used in an SQL instruction. The vulnerability belongs to CWE‑89, where uncontrolled input is incorporated into a database query. Successful exploitation could allow an attacker to read, modify, or delete sensitive data stored in the database, potentially leading to confidentiality and integrity compromises on the underlying platform.

IBM API Connect 12.1.0.0 and 12.1.1.2 are affected. The vulnerability is fixed in version 12.1.1.3; upgrading to that or later will resolve the issue.

The CVSS score of 9.9 indicates a critical severity. While the EPSS score is not available, the lack of listing in CISA KEV does not diminish the high likelihood of exploitation in a context where an authenticated attacker can interact with the API. The attack vector is inferred to be remote, with the attacker needing valid credentials to perform the injection. Organizations should treat this flaw as a top priority due to its potential for full system compromise.