IBM API Connect 12.1.0.0 and 12.1.0.3 contain hard‑coded administrative credentials that persist after installation until an explicit password change is performed. This weakness, identified as CWE‑1392, allows an attacker to authenticate as the administrator using known default credentials, granting full control over the API platform. With administrative access, an attacker can modify configuration, exfiltrate data, or disrupt services, compromising confidentiality, integrity, and availability of the system.

All installations of IBM API Connect with the released versions 12.1.0.0 or 12.1.0.3 that have not yet updated the default administrator credentials are impacted. The vulnerability is triggered by hard‑coded admin username and password that remain unchanged until a mandated credential change occurs, exposing systems that have not applied any IBM maintenance update addressing this issue.

The CVSS score of 8.1 rates this vulnerability as high severity. Exploitation requires an attacker to obtain the default credentials and remotely connect to the administrative console; no special exploits are needed. The EPSS score of < 1% indicates a very low likelihood of exploitation in the current landscape, and the vulnerability is not listed in CISA KEV. The likely attack vector is inferred from the description to be remote access to the API Connect management console using the default credentials.