The vulnerability allows a remote authenticated attacker to execute arbitrary JavaScript and access sensitive information, stemming from improper input validation. This results in a grave compromise of confidentiality, integrity, and availability as the attacker can run scripts within the context of the API Connect environment. The flaw is a classic example of cross‑site scripting (CWE‑79), and the CVSS base score of 9.9 reflects the high risk of exploitation.

Affected versions of IBM API Connect include 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. These releases are used by organizations to expose public or private APIs, and the vulnerability impacts all deployments of these versions worldwide.

The CVSS score of 9.9 indicates critical severity, while the EPSS score is not available, making it unclear how frequently attacks are attempted. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no publicly known exploitation has been documented, but the requirement of an authenticated attacker means that compromised credentials or an insider could launch the attack. The attack vector is remote over the network once the attacker can authenticate to the API Connect service, where poorly validated input can be injected to execute arbitrary JavaScript.