The vulnerability is a classic XML External Entity injection that allows a remote adversary to request arbitrary files or internal resources by crafting malicious XML documents processed by IBM API Connect. This injection can expose sensitive configuration files, credentials, or other confidential data, leading to a breach of confidentiality. The weakness aligns with CWE‑611, representing improper handling of external entities in XML parsing.

Affected are IBM API Connect versions 12.1.0.0 through 12.1.1.2 as identified by the CNA. The IBM support page recommends addressing the issue immediately by upgrading to the fixed release 12.1.1.3. The CPE strings confirm the affected scope for those product releases.

The CVSS score of 8.2 indicates high severity. With no EPSS score available, the exploitation likelihood is unknown; the issue is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the vulnerability can be triggered by sending crafted XML to an exposed API endpoint. Given the potential for remote data disclosure, the risk to organizations running the vulnerable versions is high and warrants prompt remediation.