CVE-2026-9074

Full vulnerability record from the local CVENow database.
Description

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
Severity
CRITICAL
CVSS score
9.8 (v3.1)
Vulnerability status
Analyzed
Source identifier
[email protected]
Published
2026-07-08 16:16:35.050000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
  "id": "CVE-2026-9074",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T16:16:35.050",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality."
    },
    {
      "lang": "es",
      "value": "IBM API Connect 10.0.8.0 hasta 10.0.8.9 y 12.1.0.0 hasta 12.1.0.3 contiene una vulnerabilidad de inyección SQL no autenticada en la funcionalidad de restablecimiento de contraseña."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "API Connect",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:10.0.8.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:12.1.0.3:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "10.0.8.0",
              "lessThan": "10.0.8.9",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T00:00:00+00:00",
          "id": "CVE-2026-9074",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "10.0.8.0",
              "versionEndExcluding": "10.0.8.10",
              "matchCriteriaId": "5F7752F5-8A00-4C79-9B5B-B674AD2F1E25"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "12.1.0.0",
              "versionEndExcluding": "12.1.1.0",
              "matchCriteriaId": "C2FCDDB6-E3A4-4E7A-9B59-5C1DD585D384"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7278218",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.ibm.com/support/pages/node/7278909",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}