IBM API Connect 12.1.0.0 through 12.1.1.2 contain a flaw in certificate validation that permits a remote attacker to bypass TLS checks, retrieve protected data, and modify service configuration without local privileges. The weakness allows exploitation purely via crafted network requests, exposing data that should be protected by mutual trust and enabling manipulation of configuration settings.

The affected product is IBM API Connect. All instances running version 12.1.0.0 up to and including 12.1.1.2 are at risk. Versions later than 12.1.1.2 are not listed as vulnerable.

The CVSS score of 8 indicates high severity. An EPSS score is unavailable, so the likelihood of exploitation in the wild remains uncertain. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the weakness remotely by sending crafted requests that bypass the expected TLS verification checks, which requires no prior authentication and can be performed from the public internet.