IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an OS command injection flaw that allows a remote authenticated attacker to execute arbitrary operating‑system commands. The flaw arises because user‑supplied input is not properly neutralized before it is passed to the underlying host, giving an attacker full control of the machine. The primary impact is a complete compromise of confidentiality, integrity, and availability on the affected system.

All deployments of IBM API Connect running any 10.0.8.x version from 10.0.8.0 to 10.0.8.12, or any 12.1.x version from 12.1.0.0 to 12.1.1.2, are affected. IBM strongly recommends upgrading to 10.0.8.13 or, for the 12.1.x line, to 12.1.1.3 to eliminate the vulnerability.

The CVSS score of 9.9 reflects the severity of the remote code execution risk. EPSS data is not available, so there is no current public evidence of exploitation; however, the lack of a publicly disclosed exploit does not reduce the risk of a future attack. The flaw can be triggered via a remote authenticated API or management interface—this access path is inferred from the description, which indicates that a credentialed attacker can supply malicious input. The vulnerability is not listed in the CISA KEV catalog, but the combination of privilege requirement and command injection still demands immediate attention.