CVE-2026-9074

IBM API Connect versions 10.0.8.0–10.0.8.9 and 12.1.0.0–12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

This critical (CVSS 9.1) SQL injection flaw allows attackers to bypass authentication and potentially access sensitive data without credentials, posing a severe risk to FedRAMP and NIST 800-171 systems. DIB organizations must immediately patch affected IBM API Connect instances to prevent unauthorized access and potential data exfiltration.

Shame score — A critical unauthenticated SQL injection in a password reset function is a high-severity flaw that could lead to credential bypass, though it is not yet actively exploited in the wild.