AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-9074

IBM API Connect: SQL injection

IBM

CVE-2026-9074 · Published Jul 8, 2026 · updated Jul 10, 2026

Critical9.1
Fix: upgrade to 10.0.8.9 or later
IBM advisory

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

Affected versions

PackageAffectedFixed in
API Connect
Product
>= 10.0.8.0, < 10.0.8.910.0.8.9
<= 12.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-89

More IBM advisories

All IBM
High 7.5Jul 17IBM PowerVM Novalink: denial of serviceCVE-2026-9171no fix yetCritical 9.9Jul 17IBM Langflow OSS: code injectionCVE-2026-9135no fix yetHigh 7.8Jul 17IBM Db2: remote code executionCVE-2026-9762no fix yetCritical 9.8Jul 17IBM Langflow OSS: missing authenticationCVE-2026-9202no fix yetCritical 9.8Jul 17IBM Langflow OSS: code injectionCVE-2026-9198no fix yetHigh 8.1Jul 8IBM API Connect: attacker could gain unauthorized access to the applicationCVE-2026-3144fixed in 12.1.0.3