Loading vulnerability…
Authentication Bypass in IBM API Connect
CVE-2025-13915 is a critical authentication bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. A remote, unauthenticated attacker can circumvent authentication mechanisms and gain unauthorized access to the application. Discovered during IBM internal testing, the vulnerability has a CVSS v3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The precise vulnerable function and request conditions have not been established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized access to the affected application and potentially protected APIs. Depending on the resources accessible through the bypass, consequences may include sensitive-data exposure, unauthorized modification of application data, and service disruption. The CVSS assessment indicates high potential impact to confidentiality, integrity, and availability, but does not establish arbitrary code execution or unrestricted administrative control.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable self-service sign-up on the Developer Portal if enabled, as recommended by IBM. Treat this as a temporary exposure-reduction measure rather than a replacement for patching. Restrict management-interface access to trusted networks and monitor API access and audit logs for unauthorized requests or unexpected configuration changes.
Patch, then assume compromise.
Apply IBM's version-appropriate interim fixes through IBM Fix Central or upgrade to a release explicitly identified by IBM as remediating CVE-2025-13915. Follow the deployment-specific instructions for VMware, OpenShift/Cloud Pak for Integration, or Kubernetes as applicable. After remediation, verify that protected application functions reject requests lacking valid authentication.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.