The vulnerability allows a remote authenticated attacker to execute arbitrary code and access sensitive information belonging to other tenants due to insufficient input validation when uploading custom module content. This is a type of input validation weakness classified as CWE‑184, leading to potentially broad compromise of the API Connect environment.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected. These releases are part of the IBM WebSphere API gateway product line and may be deployed in multi‑tenant corporate environments.

The CVSS score of 9.9 indicates a severe risk. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, so the exact exploitation likelihood is uncertain. The likely attack path involves a user with valid credentials uploading a malicious custom module that is not properly sanitized, enabling the execution of arbitrary code with privileges beyond the attacker's tenant.