IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a SQL injection flaw that allows a remote authenticated attacker to inject malicious SQL statements. The flaw exists in input validation for certain API endpoints, enabling the attacker to read or modify database contents and retrieve sensitive information such as user credentials, configuration data, and transaction records. This vulnerability is identified as CWE-89, a classic input validation weakness.

The affected product is IBM API Connect from IBM. Vulnerable releases are IBM API Connect v10.0.8.0 to v10.0.8.12 and v12.1.0.0 to v12.1.1.2. IBM recommends upgrading to v10.0.8.13 or v12.1.1.3 to remediate the issue, as listed in the IBM Fix Central links.

The CVSS score of 7.7 indicates a high potential impact on confidentiality for systems using these vulnerable API Connect versions. The flaw is remote and requires only authenticated access, meaning any user with valid API credentials could exploit it. EPSS is not available, so the exploitation probability is uncertain, and the issue is not yet listed in the CISA KEV catalog. Nonetheless, given its severity and the ability to expose sensitive data, administrators should consider patching immediately.