IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a cryptographic weakness that allows a local attacker to retrieve sensitive information because the encryption applied to stored data is not sufficiently strong. The flaw enables the disclosure of confidential data, directly impacting the confidentiality of data managed by the product.

The affected product is IBM API Connect, specifically versions 12.1.0.0 to 12.1.1.2 inclusive. Affected releases include the 12.1.0.0 baseline and the 12.1.1.2 build, while version 12.1.1.3 has been released with the fix.

The CVSS score of 4 indicates a medium risk severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited. Because the attack relies on local access and weak cryptographic implementation, the threat vector is local and requires legitimate or compromised local credentials.