IBM API Connect suffers from an improper output neutralization flaw in its logging subsystem that permits a remote authenticated user to forge audit records. By injecting crafted input into log‑generation code, an attacker can create false entries that appear legitimate, thereby compromising the integrity of audit trails and potentially masking malicious activity.

The affected products are IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. These releases are publicly available and used by many organizations for managing API lifecycle and governance.

The CVSS score of 5.0 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and requires the attacker to be authenticated to the platform, so while exploitation is not trivial, any successful compromise would allow manipulation of audit logs and erasure of malicious traces.