IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain hard‑coded credentials (CWE-798) that can be used by a remote attacker to obtain full administrative control. The vulnerability allows an attacker to bypass normal authentication mechanisms and gain the same privileges as a system administrator, enabling changes to configuration, deployment of arbitrary code, data exfiltration, or service disruption.

IBM:API Connect is affected on the following product lines: version 10.0.8.0 up to 10.0.8.12 and version 12.1.0.0 up to 12.1.1.2. All installations of these releases are susceptible unless updated to a patched version.

The CVSS score of 9 indicates a critical severity, but the EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in CISA KEV, yet its high severity and the remote nature of the attack vector make it a priority for remediation. An attacker who can reach the API Connect service over the network can exploit the hard‑coded credentials without additional authentication steps, making the attack path straightforward and the potential impact system‑wide.