The vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allows a remote authenticated attacker to initiate server‑side request forgery, causing the API Connect server to contact arbitrary internal or external resources. This capability can expose sensitive data, such as internal configuration, authentication tokens, or other confidential information, thereby compromising confidentiality. The flaw requires user authentication but does not need administrative privileges.

IBM API Connect 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are affected. IBM recommends upgrading to 10.0.8.13 or 12.1.1.3 to remediate the issue. All installations of the affected versions should be considered vulnerable until the corresponding update is applied.

With a CVSS score of 9.6 the flaw is classified as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high base score and the fact that it can be exploited by any authenticated user make it a high‑priority risk. The attack vector is remote, requiring valid credentials; after authentication the attacker can trigger outbound requests from the server, potentially reaching internal services and exposing data that should remain private.