A critical improper authentication flaw (CVSS 9.4) in IBM API Connect 12.1.0.0 through 12.1.1.2 could let a remote, unauthenticated attacker pose as another user, read sensitive information and change API configurations.
What Is It
CVE-2026-18838 is an improper authentication flaw in IBM API Connect. IBM's description says identity information supplied in requests is not checked well enough. A caller could use this to impersonate another user. An attacker who does so could obtain sensitive information and modify API configurations.
The weakness is classified as CWE-290 (Authentication Bypass by Spoofing). IBM's PSIRT ([email protected]) submitted the record, and NVD published it on 2026-11-07. NVD lists its status as "Awaiting Analysis," so NVD has not yet done its own review.
Why It Matters
IBM PSIRT scored the flaw 9.4 (CRITICAL) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. In plain terms:
- Attack vector: Network. It can be exploited remotely.
- Attack complexity: Low.
- Privileges required: None.
- User interaction: None.
- Impact: High to confidentiality and integrity, low to availability.
So an attacker needs no credentials and no help from a user. API Connect manages API configurations, which makes the integrity impact especially serious: an attacker could change how the managed APIs behave.
Exploitation status: The CISA KEV data supplied for this brief has no entry for this CVE. Active exploitation is therefore not confirmed by KEV at this time.
What's Vulnerable
- Vendor: IBM
- Product: API Connect
- Affected versions: 12.1.0.0 through 12.1.1.2, inclusive
The vendor-supplied CPE entries name versions 12.1.0.0 and 12.1.1.2. The version range in the record covers everything from 12.1.0.0 up to and including 12.1.1.2.
Patch Status
The NVD record does not give a fixed version or specific remediation steps. It points to an IBM support advisory as the vendor reference. Organizations running an affected API Connect version should read that advisory for fix and mitigation guidance and apply it promptly, given the critical, unauthenticated, network-reachable nature of the flaw.
There is no CISA KEV entry, so no federal required action or due date applies at this time.
Sources
- NVD, CVE-2026-18838
- IBM Support Advisory (node 7295635)
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE in supplied data)