VulnSocial

CVE-2026-9074Disclosure(ibm / api_connect)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

ibm CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • api_connect

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-04); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
ibm
Products
api_connect

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-04: 1Mentions · 2026-08-07: 1Technical Details · 2026-08-04: 1Technical Details · 2026-08-07: 108-0408-07
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-08-041
Disclosure1
2026-08-071
General1
Full discourse2 posts
  • IntegSec@integ_sec
    General

    CVE-2026-9074: IBM API Connect Unauthenticated SQL Injection - What It Means for Your Business and How to Respond https://hubs.li/Q04sdtL40

    Post summary

    The text references CVE‑2026‑9074, noting an unauthenticated SQL injection in IBM API Connect, but provides no details on PoCs, exploitation, or patching.

    0000036
    32 followersView on X
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    IBM API Connect のパスワードリセットに、認証不要のSQLインジェクション。CVSS 9.8。ログインできない人が使う画面なので、認証の手前に置かれています。10.0.8 系と 12.1.0 系の2系統が同時に対象で、片方だけ見ると取り残されます。 https://cve.autoarticles.net/cve/CVE-2026-9074

    Post summary

    IBM API Connect’s password‑reset feature is vulnerable to an unauthenticated SQL injection (CVE‑2026‑9074) with a CVSS score of 9.8, affecting versions 10.0.8 and 12.1.0.

    0000055
    561 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appibmapi_connect---

Explore more

Back to dashboardibm CVEsapi_connect vulnerabilities