IBM API Connect 10.0.8.0 through 10.0.8.12 contains a cryptographically weak pseudo‑random number generator that allows a remote attacker to gain full administrative control. The vulnerability arises because the system relies on insufficient entropy when generating authentication tokens or other randomly derived values, enabling an attacker to predict or manipulate these values and circumvent security controls. The weakness is a CWE-338 type flaw.

The affected products are IBM:API Connect versions 10.0.8.0 through 10.0.8.12. Users of these releases should verify their installation level and plan to upgrade to a newer version, such as 10.0.8.13, which is known to resolve the weakness.

The CVSS score of 8.1 indicates high severity. While the EPSS score is not available, the lack of a current KEV listing suggests no documented exploitation at this time. The likely attack vector is remote and involves interacting with the API Connect service over the network to exploit the weak random generation. Given the potential to attain full administrative authority, the risk is significant even if exploitation probability is uncertain.