IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an input validation flaw that allows a remote attacker to send arbitrary HTTP requests to internal systems. Based on the description, it is inferred that an attacker would need to craft HTTP requests targeting the API Connect server to exploit this weakness, which can lead to data exfiltration, pivoting to other services, or unauthorized actions on back‑end resources. The impact is local to the API Connect server but can affect any protected internal network.

The flaw is present in IBM API Connect product, specifically in releases 12.1.0.0 up to and including 12.1.1.2. Upgrading to version 12.1.1.3 or later resolves the vulnerability.

The CVSS score of 7.2 indicates a high risk when the vulnerability is exploitable. EPSS information is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the network, with an attacker sending crafted HTTP traffic to the API Connect server to target internal services, revealing a high‑impact attack surface for organizations that expose the API Connector externally.