IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server‑side request forgery flaw that permits a remote attacker to influence the API gateway to send requests to arbitrary internal or external destinations and to retrieve the response. This flaw can lead to disclosure of sensitive information, such as internal network details or credentials, and undermines the confidentiality and integrity of the system. The weakness is a classic example of CWE‑918: Server‑Side Request Forgery.

The vulnerable products are IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. IBM recommends upgrading to 10.0.8.13 or 12.1.1.3 respectively. The affected API Connect instances should be identified by their major release version and checked against these ranges.

The CVSS score of 9.3 indicates a high severity with critical impact potential. While the EPSS score is not available, the absence of a KEV listing does not diminish the risk; the attack can be carried out remotely over the network using crafted API requests. Successful exploitation would allow an attacker to execute arbitrary requests on behalf of the API gateway, potentially leaking internal data or gaining unauthorized access to backend services.