The vulnerability in IBM API Connect (10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2) is a server‑side request forgery that allows a remote, authenticated attacker to make the server initiate requests to arbitrary URLs. This can result in the disclosure of sensitive data that the server can access, such as internal resources or backend services, and potentially expose confidential information. The weakness is identified as CWE‑918 and can be abused without needing elevated privileges beyond an authenticated user within the API Connect system.

Affected products are IBM API Connect versions 10.0.8.0 up to 10.0.8.12, and 12.1.0.0 up to 12.1.1.2. IBM recommends upgrading to 12.1.1.3 for the 12.1 branch and to 10.0.8.13 for the 10.0.8 branch. The vulnerability is documented for the specified version range and applies to all builds within those ranges regardless of environment.

The CVSS score of 8.5 indicates a high severity risk that could be exploited by any authenticated user who can trigger an SSRF. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have seen widespread exploitation in the wild. Nevertheless, the impact of data disclosure warrants immediate attention. Attack vectors are likely to involve authenticated API calls that include maliciously crafted URLs; the attacker would then rely on the server’s outbound connectivity to reach internal targets or external services. Given the high CVSS score and lack of mitigation in older versions, the risk remains significant until a patch is applied.