CVE-2026-9074 is a critical (CVSS 9.1) unauthenticated SQL injection in the password reset feature of IBM API Connect. It affects 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3. Anyone who can reach the reset page may be able to attack the database. Read the IBM bulletin for the fixed releases and update.
What's affected
The record lists:
- IBM API Connect 10.0.8.0 through 10.0.8.9
- IBM API Connect 12.1.0.0 through 12.1.0.3
The flaw sits in the password reset function and needs no login. The IBM bulletin pages could not be rendered when this guide was written, so I cannot quote the fixed versions. Read the bulletins listed below for the interim fix or release that applies to your line.
How to check if you're exposed
Find the version of each API Connect deployment. On Kubernetes or OpenShift installs, check the version of the management subsystem custom resource, or read it in the Cloud Manager interface. Compare it with the ranges above.
Then see who can reach the password reset page. If the management or developer portal is open to the internet, the unauthenticated attack path is exposed to everyone. Check your web application firewall logs for odd requests to the reset endpoint.
What to do now
- Find every API Connect instance and its version.
- Read the IBM bulletins and install the fixed release or interim fix for your line.
- Until patched, limit access to the password reset page to trusted networks, if your design allows.
- Review logs of the reset endpoint for repeated or malformed requests, and review the database for unexpected changes.
- Plan a credential reset for affected accounts if you find signs of misuse.
Why it matters
The weakness is CWE-89 (SQL injection). User input from the reset form reaches a database query without being kept apart from the query text, so crafted input can change what the query does. The record rates confidentiality and integrity impact as high.
Password reset pages are reachable without a login by design, so any flaw there is open to anyone. Parameterized queries are the standard fix, and they should be used in every code path that touches the database.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
API gateways front many services. A scan of the endpoints your gateway exposes shows which ones deserve the closest look.
Click through it at your own pace, or open it full screen.
Quick check
Do I need a login to exploit this?
No. The record calls it unauthenticated, and the weakness is in the password reset function.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
