The vulnerability is a path traversal flaw in IBM API Connect that allows a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions. This flaw, identified as CWE-22, undermines the confidentiality, integrity, and availability of the system by breaking the isolation of file system paths during processing. An attacker who can authenticate to the API Connect environment can supply specially crafted file paths to overwrite or read sensitive files, leading to full system compromise.

IBM API Connect instances running versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. The product is IBM API Connect, a REST API management platform used to design, secure, and deploy APIs. Organizations that log into the management console or use the API gateway with these releases may be impacted until the listed fixes are applied.

The CVSS score of 9.9 marks this issue as critical, yet EPSS data is missing, so the precise exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but the combination of a high severity score and the requirement of only an authenticated user makes it attractive for adversaries that have gained lateral or initial access. Exploitation requires the supply of a crafted path to a privileged API endpoint, which can lead to arbitrary code execution on the host.