CVE-2026-9074 is an unauthenticated SQL injection vulnerability (CWE-89) affecting IBM API Connect in specific versions of 10.0.8.x and 12.1.0.x. The flaw exists in the password reset functionality, allowing attackers to inject malicious SQL commands without requiring authentication. This can lead to unauthorized data disclosure and modification, impacting confidentiality and integrity. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability can result in unauthorized disclosure and modification of sensitive data within the IBM API Connect environment due to SQL injection in the password reset feature. The attack requires no authentication and can be performed remotely, making it highly impactful on confidentiality and integrity. Availability impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor IBM's security advisories for updates. Until a patch is available, consider restricting access to the password reset functionality or implementing compensating controls such as web application firewalls to detect and block SQL injection attempts.