Intel

CVE-2026-9074

api_connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVE-2026-9074)

criticalEPSS 0.5%

Affected

  • ibm/api_connect between 10.0.8.0..10.0.8.10
  • ibm/api_connect between 12.1.0.0..12.1.1.0

Description

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

Source: NVD (NIST)cvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

ibmapi_connect
10.0.8.0 – 10.0.8.1012.1.0.0 – 12.1.1.0

Metrics

XIEM Effective CVSS
9.8
Source: nvd-v3
EPSS percentile
41.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
80.92
Exploit maturity
no public PoC known
CVSS v3
9.1
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-08 15:24 UTC
CWE
CWE-89

Weakness classes (CWE)

  • CWE-89Base

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

    cwe.mitre.org →

References & sources

Linked advisories