The vulnerability is a server‑side request forgery (CWE‑918). A remote attacker who can authenticate to IBM API Connect can cause the server to initiate HTTP requests to arbitrary internal or external addresses, allowing the attacker to read sensitive data that resides inside the network or on third‑party services. This exposes confidential information and could facilitate further compromise.

Affected products are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability exists in the advertised versions enumerated in the CPE list. Users running these releases should verify their current version to determine exposure.

The CVSS base score is 7.7 which reflects a high risk due to authentication and data exposure. EPSS data is not available, so the current public exploitation probability is unknown. The issue is not yet listed in CISA KEV. The exploit requires the attacker to have valid credentials to the API Connect instance; once authenticated, the attacker can issue malicious requests to any target reachable from the server. The attack vector is remote, authenticated with server‑side request capability.