A response discrepancy in IBM API Connect enables an attacker who can send requests to the service to deduce sensitive data. The vulnerability resides in the way certain API responses differ for different inputs, allowing a remote user to infer confidential information. This flaw is classified as a confidential data exposure (CWE-200) and is reflected in a moderate CVSS score of 5.8, indicating that the impact is significant if exploited. The description does not mention privilege escalation or denial of service, so the primary risk is loss of confidentiality rather than availability or integrity. Based on the information available, the most likely attack involves an externally‑exposed API endpoint that can be reached without authentication or with insufficient restrictions.

IBM API Connect products are affected. The vulnerable versions are those numbered 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The fix applies to all releases within those ranges, so administrators must identify which line their deployment is on and ensure it is updated to a non‑vulnerable build.

The CVSS score of 5.8 indicates moderate severity. No EPSS score is available, leaving the likelihood of exploitation uncertain; however, the vulnerability is publicly documented, and there is no indication that it has already been exploited, as it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, likely engaged through HTTP requests to the API Connect endpoints, which is typical for this type of correlation flaw. Because the flaw relies on observable differences in responses, an attacker can launch an automated probe to enumerate sensitive values, making the exploitation plausible for a motivated actor. The lack of a known exploit that has been observed in the wild suggests that, while the risk is present, the immediacy of exploitation may be lower than for a denial‑of‑service or remote code execution flaw.