API Connect (12.1.0.0) - CraftedSignal Threat Feed

CVE-2026-3144 - IBM API Connect Default Credentials Vulnerability

hello@craftedsignal.io — Wed, 08 Jul 2026 16:25:27 +0000

IBM has disclosed CVE-2026-3144, affecting IBM API Connect versions 12.1.0.0 through 12.1.0.3. This critical vulnerability stems from the application's use of default credentials, which attackers can leverage to gain unauthorized access. The issue allows threat actors to bypass authentication mechanisms before the system enforces a mandatory credential update. This provides a straightforward initial access vector, enabling adversaries to potentially control API configurations, access sensitive data, or establish further persistence within compromised environments. Organizations utilizing the affected versions should prioritize immediate remediation to prevent unauthorized exploitation and mitigate the risk of severe operational and data security impacts.

Attack Chain

Attacker conducts reconnaissance to identify internet-facing IBM API Connect instances within versions 12.1.0.0 through 12.1.0.3.
Attacker attempts to authenticate to the identified API Connect management interface (e.g., via the login endpoint) using commonly known default usernames and passwords (e.g., 'admin'/'admin', 'user'/'password').
Due to the vulnerability (CWE-1392), the application successfully authenticates the attacker using the hardcoded or easily guessable default credentials.
Attacker gains full unauthorized access to the IBM API Connect management console and its functionalities, inheriting privileges associated with the default account.
Attacker performs actions such as modifying API definitions, creating new APIs, or accessing API analytics and sensitive configuration data.
The unauthorized access could enable sensitive data exposure, API manipulation, or the establishment of a foothold for lateral movement into connected internal systems.

Impact

Exploitation of CVE-2026-3144 grants an unauthenticated attacker high privileges over the IBM API Connect platform, as indicated by its CVSS 3.1 score of 8.1. If successfully exploited, adversaries can gain complete control over API management, potentially leading to widespread disruption of services, unauthorized data access or exfiltration, and the creation of backdoors for future access. Organizations managing critical business APIs via affected versions face significant risks, including reputational damage, compliance failures, and severe operational interruptions if their API infrastructure is compromised. The vulnerability applies to any organization using the specified versions of IBM API Connect.

Recommendation

Immediately apply patches or upgrade IBM API Connect to a version that remediates CVE-2026-3144 as per the vendor advisory https://www.ibm.com/support/pages/node/7278909.
Ensure all default credentials for IBM API Connect instances are changed to strong, unique passwords immediately upon deployment and configuration.
Implement robust monitoring for all authentication attempts, specifically looking for successful logins by default or newly created privileged accounts from unusual source IP addresses or locations within your webserver category logs.
Review access logs for the IBM API Connect management interface (from your webserver logs) for suspicious login patterns or unauthorized API manipulation attempts.

Unauthenticated SQL Injection in IBM API Connect (CVE-2026-9074)

hello@craftedsignal.io — Wed, 08 Jul 2026 16:24:32 +0000

A critical unauthenticated SQL injection vulnerability, tracked as CVE-2026-9074 (CVSS v3.1 Base Score: 9.1), affects IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3. This flaw resides within the password reset functionality of the API management platform, allowing a remote attacker to inject malicious SQL queries without requiring any prior authentication. Successful exploitation of this vulnerability could enable an attacker to bypass authentication mechanisms, gain unauthorized access to sensitive database information, or potentially manipulate data, posing a significant risk to the integrity and confidentiality of the affected systems and user accounts. Organizations utilizing the specified vulnerable versions of IBM API Connect are strongly urged to apply the available patches immediately to mitigate this severe risk.

Attack Chain

An unauthenticated attacker identifies an exposed IBM API Connect instance running a vulnerable version (10.0.8.0-10.0.8.9 or 12.1.0.0-12.1.0.3).
The attacker accesses the publicly available password reset functionality of the IBM API Connect web interface.
The attacker crafts and submits a specially malformed request to the password reset endpoint, embedding SQL injection payloads within input fields or parameters that are processed by the application's backend database.
The vulnerable application processes the malicious input without proper sanitization, leading to the execution of the attacker's arbitrary SQL commands within the database.
Depending on the crafted payload, the attacker might retrieve sensitive information from the database (e.g., user credentials, API keys) or bypass authentication to gain unauthorized access to user accounts.
Upon successful data exfiltration or authentication bypass, the attacker can leverage the compromised credentials or access tokens for further malicious activities within the API Connect environment.

Impact

Successful exploitation of CVE-2026-9074 can lead to severe consequences for organizations. Due to the unauthenticated nature of the vulnerability, any attacker can initiate the exploitation. The primary impacts include unauthorized access to sensitive data stored in the backend database, such as user account details, API configurations, or other critical system information. Attackers could also achieve authentication bypass, gaining full control over administrative or user accounts within the IBM API Connect instance. This could lead to further compromise of managed APIs, data exfiltration, service disruption, or unauthorized modification of system settings, severely compromising the confidentiality and integrity of the API management platform and the services it exposes.

Recommendation

Patch CVE-2026-9074 immediately by updating IBM API Connect to a fixed version beyond 10.0.8.9 or 12.1.0.3, as described in the IBM support advisories referenced.
Deploy the Sigma rule "Detect CVE-2026-9074 Exploitation Attempt - IBM API Connect SQL Injection" to your SIEM and tune for your environment to detect attempts against the password reset functionality.
Monitor web server logs for suspicious requests to password reset endpoints containing common SQL injection patterns.