A weak cryptographic pseudo‑random number generator used by IBM API Connect 10.0.8.0 through 10.0.8.12 permits a local attacker to gain access to sensitive information. The weakness, classified as CWE‑338, allows the attacker to predict or recover random values that may contain credentials or secret keys, leading to data exposure. The impact is limited to confidentiality; an attacker must have local access to the system that runs the API Connect instance.

IBM API Connect versions 10.0.8.0 up to and including 10.0.8.12 are affected. The vendor recommends upgrading to 10.0.8.13 or later, which incorporates a stronger random number generator and resolves the vulnerability.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity. No EPSS score is available to gauge exploitation likelihood, and it is not listed in CISA’s KEV catalog. The vulnerability can be exploited from a local position, so it requires the attacker to have some level of local access or privileged user rights on the API Connect host. Because the attack vector is local and the weakness is a predictable RNG, immediate remediation reduces the risk of covert information leakage.