The vulnerability permits a remote authenticated attacker to influence the code generation that IBM API Connect performs. By submitting specially crafted input, an attacker can cause the product to generate and execute arbitrary code. The flaw is a form of code injection, specifically CWE-94, and can lead to remote code execution on the host where the API Connect instance is running. The exposed capability can compromise confidentiality, integrity, and availability of the service and potentially the underlying infrastructure.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. The issue exists in the IBM:API Connect product suite. The CVE affects deployments that enable user supplied input processed by the API Connect code generator.

The CVSS score is 3.3, indicating a low overall score, but the impact is severe since it is an RCE. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires remote authenticated access, meaning an attacker must first obtain valid credentials. Once authenticated, the attacker can exploit the flaw to execute arbitrary code, making the security risk significant for environments that rely on API Connect for exposed APIs. The low score may cause some organizations to delay remediation, but the potential damage warrants prompt action if authentication mechanisms are weak.