CVE-2026-3144 is a high severity default credentials flaw (CVSS 8.1) in IBM API Connect 12.1.0.0 through 12.1.0.3. An attacker could gain access before the system forces a credential change. IBM recommends upgrading to v12.1.1.0 and lists no workaround.
What's affected
IBM's bulletin lists API Connect V12 OnPrem, all versions, as affected, and the record narrows it to 12.1.0.0 through 12.1.0.3. IBM recommends upgrading to v12.1.1.0.
How to check if you're exposed
Check the version in your API Connect management console or with your install records, and compare it with 12.1.1.0.
Also check whether any new or reset install still has its initial credentials, and whether the management endpoints are reachable from outside your network.
What to do now
- Upgrade to API Connect v12.1.1.0 using IBM's Fix Central, as the bulletin recommends.
- Change any initial credentials as soon as an instance is installed.
- Keep management interfaces on a private network.
- IBM lists no workarounds or mitigations, so planning the upgrade is the main step.
Why it matters
The weakness class is CWE-1392, use of default credentials. The product starts with known credentials and only enforces an update afterward, so there is a window where anyone who knows the defaults can sign in.
IBM's CVSS vector lists high attack complexity, which reflects that the window is limited. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Where is IBM's guidance?
In the IBM bulletin for API Connect, linked below. It lists the upgrade to v12.1.1.0 and no workarounds.
Sources
Last reviewed: 19 October 2026.
