External risk intelligence

IBM API Connect SQL Injection in Password Reset.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-9074

The vulnerability exists within a password reset function of an API management platform. Such portals are designed to be accessible to external users or administrators, making this surface typically exposed to the internet by design to facilitate identity and account management.

SQL Injection

Ibm Api Connect

10.0.8.0 to before 10.0.8.1012.1.0.0 to before 12.1.1.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in IBM API Connect, specifically within its password reset feature. This flaw allows for SQL injection without requiring authentication, meaning an attacker could potentially access or manipulate sensitive data.

Unauthenticated access to password reset functions.
Protects critical API management system integrity.
Confirm exposure and relevance of API Connect.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending a specially crafted request to the password reset function of an affected IBM API Connect system. Since no authentication is required, an attacker can directly interact with this feature. If successful, this could allow an attacker to manipulate database queries.

No authentication needed.
Password reset function.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code through the password reset functionality of IBM API Connect. When supported by the advisory, this could lead to unauthorized access to or modification of the underlying database.

Database integrity and confidentiality.
Unauthenticated SQL injection via password reset.
Unauthorized database access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in IBM API Connect's password reset function requires swift action from application owners, platform teams, and potentially network security teams. The immediate priority is to locate all instances of the affected product, assess their exposure and business criticality, and identify the accountable owner. Remediation planning should then be based on this risk assessment.

Application and platform teams should own the issue.
Verify external access and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect used for?

IBM API Connect is an enterprise platform used to create, manage, secure, and monitor application programming interfaces. It acts as a gateway that controls how internal and external services communicate, ensuring that data exchanges are structured and authenticated. It is widely used by organizations to expose their digital services to developers and partners while maintaining control over traffic and security policies.

What is the CVE-2026-9074 vulnerability?

This vulnerability is a form of SQL injection, classified as CWE-89. It occurs when a system incorrectly handles input, allowing untrusted data to interfere with database queries. In this specific case, the weakness exists within the software's password reset mechanism, which can be manipulated to interact with the backend database in unintended ways.

How does an attacker trigger this SQL injection?

An attacker triggers this flaw by sending a specially crafted request directly to the password reset function of an affected IBM API Connect system. Because the vulnerability does not require any prior authentication, no login or session is needed to initiate the attack. Simply visiting the application or submitting the reset request does not trigger the bug; it requires specific, malicious input designed to alter the database query.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as an external threat because the password reset functionality is typically designed to be reachable from the internet to support legitimate users. Since this feature is often exposed to facilitate account recovery, an attacker does not need internal network access to reach the vulnerable component.

What steps should I take if I run IBM API Connect?

The first step is to identify all instances of IBM API Connect within your environment. Once located, verify which systems are accessible from the internet and evaluate their business criticality. Coordinate with your platform and application teams to determine the risk level, and prioritize applying vendor-supplied updates or security configurations to mitigate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.