IBM API Connect vulnerabilities

81 CVEs affecting IBM API Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9074, published 2026-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-13915, published 2025-12-26. Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days. IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
CVE-2019-4382, published 2019-06-25. Medium severity, CVSS 5.3. EPSS: 7.8% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.
CVE-2019-4202, published 2019-04-15. Critical severity, CVSS 10.0. EPSS: 4.2% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to…
CVE-2018-1778, published 2018-12-20. High severity, CVSS 8.1. EPSS: 3.4% chance of exploitation in the next 30 days. IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for…
CVE-2018-1932, published 2019-01-08. Medium severity, CVSS 4.9. EPSS: 3.2% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive…
CVE-2018-2011, published 2019-06-25. Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days. IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the…
CVE-2018-1469, published 2018-04-04. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially crafted HTTP requests. IBM X-Force ID: 140605.
CVE-2019-4155, published 2019-04-08. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (OIDC) user registry. IBM X-Force ID: 158544.
CVE-2019-4460, published 2019-08-20. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot…
CVE-2018-1779, published 2018-11-20. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size. IBM X-Force ID: 148802.

Latest

CVE-2026-9074, published 2026-07-08. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
CVE-2026-3144, published 2026-07-08. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.
CVE-2023-47722, published 2023-12-09. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912.
CVE-2023-28522, published 2023-05-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585.
CVE-2022-34350, published 2023-02-08. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack, caused by improper validation of…
CVE-2021-38997, published 2022-12-12. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the…
CVE-2021-29772, published 2021-08-26. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.
CVE-2021-29715, published 2021-08-26. Critical severity, CVSS 9.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due to open ports. IBM X-Force ID: 201018.
CVE-2020-4706, published 2021-08-17. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote…