The vulnerability is a server‑side request forgery that allows a remote authenticated attacker to cause the API Connect server to make arbitrary HTTP requests and return the results to the attacker. This can expose sensitive internal data such as configuration files, internal service responses, or other confidential content. The flaw is classified as CWE‑918 and carries a high‑severity CVSS score of 9.9, indicating that a successful exploit would lead to confidentiality compromise with no direct impact on integrity or availability.

The affected products are IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vendor recommends upgrading any instance to the patched releases of 10.0.8.13 or 12.1.1.3.

The CVSS score of 9.9 marks this flaw as critical, and while no EPSS score is provided, the severity indicates a high likelihood of exploitation in a relevant environment. The breach is remote but requires valid authentication to the API, so environments with open or weak authentication controls are at greater risk. The flaw is not listed in the CISA KEV catalog, but the lack of mitigation in the server’s request handling warrants immediate action.