Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-9074: IBM API Connect Password Reset SQL Injection
CVE-2026-9074
CVE-2026-9074
Summary
IBM API Connect versions 10.0.8.0 to 10.0.8.9 and 12.1.0.0 to 12.1.0.3 have a security weakness in the password reset feature. An attacker can access sensitive data without needing a password. To stay secure, update to the latest version of IBM API Connect or apply the recommended patches.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | api connect | < 10.0.8.9 |
| ibm | api_connect |
>= 10.0.8.0, < 10.0.8.10 >= 12.1.0.0, < 12.1.1.0 cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:* |
Original title
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
Original description
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
nvd CVSS3.1
9.1
Vulnerability type
CWE-89
SQL Injection
Published: 8 Jul 2026 · Updated: 23 Jul 2026 · First seen: 8 Jul 2026