The vulnerability exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2 and permits a remote authenticated attacker to gain arbitrary code execution by exploiting a path traversal flaw. This flaw can be triggered when the attacker supplies an input that causes the system, likely during API handling, to resolve a file path outside the intended directory. Once executed, the attacker can run arbitrary code on the host, compromising confidentiality, integrity, and availability of the entire API Connect installation. The weakness is categorized as CWE‑22, indicating a relative or absolute path traversal.

The affected products are IBM API Connect version 12.1.0.0 up to and including 12.1.1.2. Users running those specific releases are vulnerable. The vendor shipped a fix in version 12.1.1.3, which is not listed in the CISA KEV catalog. No other product versions are known to share the vulnerability.

The CVSS base score of 9.9 classifies the flaw as critical. The lack of an EPSS entry means an exact probability is not currently available, but the high severity suggests a non‑negligible exploitation likelihood. Because the flaw requires an authenticated attacker, it is not directly exploitable by the public; however, any compromised credentials or insider threats could use the attack vector. The vulnerability is not yet recorded in the KEV list, indicating that a known exploit has not been observed in the wild, though that status can change. The path traversal mechanism suggests attackers could supply specially crafted API calls to trigger file system access outside the intended boundaries if they control the request content.