"The vulnerability, tracked as CVE-2025-13915, is rated 9.8 out of a maximum of 10.0 on the CVSS scoring system. It has been described as an authentication bypass flaw. "IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application," the tech giant said in a bulletin. Customers are advised to follow the steps outlined below - Download the fix from Fix Central Extract the files: Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz Apply the fix based on the appropriate API Connect version"
""Customers unable to install the interim fix should disable self-service sign-up on their Developer Portal if enabled, which will help minimise their exposure to this vulnerability," the company added. API Connect is an end-to-end application programming interface (API) solution that allows organizations to create, test, manage, and secure APIs located on cloud and on-premises. It's used by companies like Axis Bank, Bankart, Etihad Airways, Finologee, IBS Bulgaria, State Bank of India, Tata Consultancy Services, and TINE. While there is no evidence of the vulnerability being exploited in the wild, users are advised to apply the fixes as soon as possible for optimal protection."
A critical authentication-bypass vulnerability (CVE-2025-13915) in IBM API Connect carries a CVSS score of 9.8 and can allow remote attackers to bypass authentication and gain unauthorized access. IBM provides an interim fix available from Fix Central and instructs customers to extract Readme.md and ibm-apiconnect-<version>-ifix.13195.tar.gz and apply the appropriate fix for their API Connect version. As a temporary mitigation, customers unable to install the fix should disable self-service sign-up on Developer Portals. API Connect is widely used by banks, airlines, and enterprises. No in-the-wild exploitation has been reported; prompt patching is recommended.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]