IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 have a critical (CVSS 9.6) flaw that combines a Regular Expression Denial of Service (ReDoS) with improper neutralisation of wildcard query operators.
What Is It
CVE-2026-18535 affects IBM API Connect. IBM's PSIRT describes it as a Regular Expression Denial of Service (ReDoS) issue together with improper neutralisation of wildcard query operators. The primary weakness is CWE-1333 (Inefficient Regular Expression Complexity).
The record was published to NVD on 2026-11-07. Its status is "Awaiting Analysis," which means NVD has not yet added its own enrichment. The severity data below comes from IBM as the CNA.
Why It Matters
IBM rates the flaw 9.6, CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H:
- Network-reachable with low attack complexity
- Needs only low privileges and no user interaction
- Scope changed: the impact can reach beyond the vulnerable component
- High confidentiality impact and high availability impact, no integrity impact
API Connect usually sits in front of an organisation's APIs. A low-privileged attacker who can slow or stall it could disrupt the services behind it. The high confidentiality score suggests that abusing wildcard query operators could expose data.
As of 2026-11-07, CVE-2026-18535 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so the available data does not confirm active exploitation. That can change, and with a 9.6 score and a low barrier to attack, the flaw deserves priority anyway.
What's Vulnerable
The vendor is IBM and the product is API Connect. Affected versions:
- 10.0.8.0 through 10.0.8.12 (inclusive)
- 12.1.0.0 through 12.1.1.2 (inclusive)
IBM's default status for other versions is "unaffected."
Patch Status
IBM has published two support pages for this CVE, linked below. The supplied NVD data does not list fixed versions or specific remediation steps. Because the CVE is not in the CISA KEV catalog as of 2026-11-07, CISA has not set a required action or due date for it.
Administrators running an affected 10.0.8.x or 12.1.x release should:
- Read both IBM advisories for fixed releases or interim fixes and apply them.
- Check which API Connect version is deployed against the affected ranges above.
- Watch for NVD analysis updates and any future KEV listing.
Sources
- NVD, CVE-2026-18535
- IBM Support; Security Bulletin (node 7291753)
- IBM Support; Security Bulletin (node 7292434)
- CISA, Known Exploited Vulnerabilities Catalog (checked 2026-11-07; CVE-2026-18535 not listed)