IBM warns of critical API Connect bug enabling remote access

IBM disclosed a critical API Connect flaw (CVE-2025-13915, CVSS 9.8) that allows remote access via an authentication bypass. API Connect is IBM’s API management platform used to create, secure, manage, publish and monitor APIs across environments. The advisory states the vulnerability could let a remote attacker bypass authentication and gain unauthorized access to the application, with affected versions listed as API Connect V10.0.8.0–V10.0.8.5 and V10.0.11.0.

As a workaround, customers unable to apply the interim fix should disable self-service sign-up on the Developer Portal to reduce exposure, and there is currently no evidence of active exploitation; users are urged to apply the fixes promptly to ensure protection. according to IBM