IBM API Connect 12.1.0.0 through 12.1.1.2 allows a remote authenticated attacker to insert malicious SQL commands due to the presence of an unsanitized input field, a classic SQL injection flaw identified as CWE-89. The vulnerability can cause the attacker to execute arbitrary SQL statements against the underlying database, potentially leading to data disclosure, modification, or deletion. Because the execution is not limited to read‑only statements, the impact includes loss of data integrity and confidentiality.

The vulnerability impacts IBM API Connect products version 12.1.0.0 up to and including 12.1.1.2. These affected releases provide a configuration example that includes vulnerable endpoints which do not properly validate user input, exposing the entire database to injection attacks.

The CVSS score of 9.9 indicates a high‑severity flaw. Ephemeral evidence of exploitation is not reported, EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The known attack vector is remote authenticated access, meaning an attacker who gains legitimate credentials to the API Connect instance can exploit the flaw without needing additional privileges. Once authenticated, the attacker can inject malicious SQL commands, potentially taking full control of the database. The lack of public exploitation data does not diminish the severity; patching remains critical.