← Vulnerability feed

Vulnerability record · CVE-2026-9074 · published 8 July 2026

CVE-2026-9074: Ibm api connect sql injection vulnerability

Ibm · Api Connect

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

9.8 CVSS 3.1 Critical EPSS 0.51% · top 59.1% CWE-89 · SQL injection
9.8CVSS 3.1 base score
0.51%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
10 Jul 2026Last modified by NVD

Description

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7278218 Vendor Advisory
https://www.ibm.com/support/pages/node/7278909 Vendor Advisory

Track CVE-2026-9074 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-4202Ibm api connect os command injection vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitra…EPSS 4.2%9.9CVE-2018-1789Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery atta…EPSS 1.2%9.9CVE-2018-1712Ibm api connect cross-site request forgery vulnerabilityIBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input p…EPSS 0.71%9.8CVE-2026-3144Ibm api connect vulnerabilityIBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application befor…EPSS 0.41%9.8CVE-2025-13915Ibm api connect vulnerabilityIBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized acce…EPSS 9.0%9.8CVE-2021-29772Ibm api connect code injection vulnerabilityIBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.EPSS 0.92%9.8CVE-2019-4203Ibm api connect server-side request forgery (ssrf) vulnerabilityIBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially …EPSS 1.7%9.8CVE-2019-4155Ibm api connect vulnerabilityIBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2026-9074), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.