CVE-2025-13915
Published: 26 December 2025
Summary
CVE-2025-13915 is a critical-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Ibm Api Connect. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-13915 is an authentication bypass vulnerability (CWE-305) in IBM API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0. Published on 2025-12-26, it enables a remote attacker to circumvent authentication mechanisms and obtain unauthorized access to the application. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and high impact potential.
A remote attacker with no required privileges or user interaction can exploit this vulnerability over the network with low complexity. Successful exploitation allows the attacker to gain unauthorized access to the application, resulting in high impacts on confidentiality, integrity, and availability.
IBM provides details on the vulnerability, including mitigation and patch information, in its security advisory at https://www.ibm.com/support/pages/node/7255149. Security practitioners should consult this reference for version-specific remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205432
Vulnerability details
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-13915 is an authentication bypass in IBM API Connect, a public-facing application, enabling remote exploitation for unauthorized access (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the authentication bypass vulnerability by requiring timely identification, reporting, and correction of flaws such as this CVE through vendor patching.
Enforces approved access authorizations in accordance with policy, preventing unauthorized access resulting from authentication bypass.
Requires robust identification and authentication for users, addressing the core authentication mechanism bypass exploited in this CVE.