IBM API Connect versions 12.1.0.0 through 12.1.1.2 are vulnerable to an XML External Entity (XXE) injection that could allow a remote attacker to obtain sensitive information. This vulnerability has a high severity score of 8.2 and does not require user interaction or privileges to exploit. The flaw affects confidentiality but not integrity or availability.