MinorCritical vulnerability

CVE-2026-75590 (CVSS 7.2)

NVD · officialPublished Nov 7, 2026Risk 23/100EPSS 0.4%

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.

Technical details

CVSS

7.2

AV:NetworkAC:LowPR:NoneUI:NoneC:LowI:LowA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source