According to IBM, a server-side request forgery (SSRF) vulnerability in IBM API Connect could allow a remote attacker with no authentication to make the affected component send requests to unintended destinations and return the responses.
What Is It
CVE-2026-18836 is a server-side request forgery weakness (CWE-918) in IBM API Connect. IBM's description says a remote attacker could obtain sensitive information because the affected component "can be made to send requests to unintended destinations and return the response to the attacker."
IBM's PSIRT reported the issue, and NVD published it on 2026-11-07. Its NVD status is currently "Awaiting Analysis."
Why It Matters
IBM scored the flaw 9.3 (CRITICAL) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. In plain terms:
- Network-reachable and low attack complexity
- No privileges and no user interaction required
- Changed scope: the impact can reach resources beyond the vulnerable component itself
- High integrity impact and low confidentiality impact, with no availability impact
IBM's description says the responses to forged requests are returned to the attacker. If that holds, the flaw could expose data from destinations the attacker could not otherwise reach.
Exploitation status: CVE-2026-18836 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The KEV data supplied had no entry for it, so active exploitation is not confirmed, and no CISA required action or due date applies.
What's Vulnerable
IBM lists these IBM API Connect versions as affected:
- 10.0.8.0 through 10.0.8.12
- 12.1.0.0 through 12.1.1.2
Patch Status
The NVD record does not name fixed versions or remediation steps. IBM has published two support bulletins for this CVE (linked below). Administrators running affected versions should check those bulletins for fixed releases and mitigation guidance. They should also prioritize this flaw because of its critical score and unauthenticated network attack vector.