{"id":"CVE-2026-18535","kind":"vulnerability","aliases":["CVE-2026-18535"],"related":[],"title":"IBM API Connect Analytics: regex flaw allows denial of service and wildcard query injection","description":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.","summary":"IBM says the API Connect Analytics component (analytics-v2-director) in the v10.0.8 release stream is vulnerable to ReDoS and to improper neutralisation of wildcard query operators (CWE-1333, IBM CVSS 9.6, PR:L, network). IBM's bulletin lists the affected product as API Connect V12 OnPrem v12.1.0.0 - v12.1.1.2, fixed in v12.1.1.3. The description and the bulletin disagree on stream (v10.0.8 vs v12.1), so treat both as potentially affected. No workaround.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"API Connect V12 OnPrem","fixed":["12.1.1.3"],"affected":">= 12.1.0.0, <= 12.1.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["analytics","api-gateway","ibm-api-connect","self-hosted","vendor"],"not_affected_if":["unaffected-version","v12.1.1.3-or-later"],"how_to_check":"Check your API Connect version. IBM's bulletin lists V12 OnPrem v12.1.0.0 - v12.1.1.2 as affected. NVD-derived ranges also say 10.0.8.0 - 10.0.8.12, but IBM's 10.0.8.13 bulletin does not list this CVE, so confirm with IBM support. Relevant component: Analytics (analytics-v2-director).","fix":"API Connect V12 OnPrem: upgrade to v12.1.1.3 (IBM bulletin; Fix Central https://www.ibm.com/support/pages/node/7290205). For the 10.0.8 stream no fixed version is named in the bulletin that lists this CVE; IBM's 10.0.8.13 bulletin does not list CVE-2026-18535.","status":"open","published_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","triaged_at":"2026-11-07T05:48:24+00:00","updated_at":"2026-11-07T05:50:02+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-07T05:48:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM API Connect: regex flaw enables denial of service and query injection","impact":"medium","summary":"IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The same versions also fail to neutralise wildcard query operators, so an attacker can make the service spend excessive CPU or change how queries behave.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-api-connect","api-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"service slowdown or denial, and altered query matching","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version, the affected endpoint, and whether authentication is required; NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-18535) alone gives no fix.","how_to_check":"- Check the installed API Connect version against the affected ranges 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organisations running IBM API Connect in the affected version ranges are exposed. The sources do not describe the exact request path or configuration that triggers the flaw, so the scope beyond the version ranges is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4242,"output_tokens":591,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for this CVE for the fixed version, the affected endpoint, and whether authentication is required; NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-18535) alone gives no fix.","search":"'-1333':66B '-18535':17A,20A '-2026':16A,19A '10.0.8.0':112C '10.0.8.12':114C '12.1.0.0':116C '12.1.1.2':118C '9.6':69B 'affect':78B,106B 'allow':7A 'analyt':4A,25B,42B,45B 'analytics-v2-director':44B 'api':2A,21A,27B,31B,40B,81B,110C 'api-gateway':26B 'attack':129C 'bulletin':75B,94B 'compon':43B 'connect':3A,22A,32B,41B,82B,111C 'cve':15A,18A 'cvss':68B 'cwe':65B 'denial':8A,125C 'descript':91B 'director':47B 'disagre':95B 'express':124C 'fix':87B 'flaw':6A 'gateway':28B 'host':35B 'ibm':1A,30B,37B,67B,73B,109C 'ibm-api-connect':29B 'improp':59B,132C 'inject':14A 'l':71B 'list':76B 'network':72B 'neutralis':60B,133C 'onprem':24A,84B 'oper':64B,137C 'potenti':105B 'pr':70B 'product':79B 'queri':13A,63B,136C 'redo':56B,128C 'regex':5A 'regular':123C 'releas':51B 'say':38B 'self':34B 'self-host':33B 'servic':10A,127C 'stream':52B,97B 'treat':102B 'v10.0.8':50B,98B 'v12':23A,83B 'v12.1':100B 'v12.1.0.0':85B 'v12.1.1.2':86B 'v12.1.1.3':89B 'v2':46B 'vendor':36B 'vs':99B 'vulner':54B,120C 'wildcard':12A,62B,135C 'workaround':108B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed (on-prem) IBM API Connect with the Analytics subsystem, V12 v12.1.0.0 - v12.1.1.2 per IBM's bulletin. The flaw needs a low-privileged authenticated network user (PR:L). The 10.0.8 stream is named in the CVE description but the bulletin does not confirm it or give a fix. Others can skip it.","tier":"B","verified":{"mitigations":{"at":"2026-11-07T05:50:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-37","run_id":1962},"workarounds":{"at":"2026-11-07T05:50:02Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-37","run_id":1962}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apiconnectv12onprem","connectv12onprem"],"ptokens":["api","connect","onprem","v12"],"labels":["analytics","apigateway","critical","ibmapiconnect","selfhosted","vendor"],"campaign_type":null,"search_a":"'-18535':17A,20A '-2026':16A,19A 'allow':7A 'analyt':4A 'api':2A,21A 'connect':3A,22A 'cve':15A,18A 'denial':8A 'flaw':6A 'ibm':1A 'inject':14A 'onprem':24A 'queri':13A 'regex':5A 'servic':10A 'v12':23A 'wildcard':12A","search_b":"'-1333':66B '9.6':69B 'affect':78B,106B 'analyt':25B,42B,45B 'analytics-v2-director':44B 'api':27B,31B,40B,81B 'api-gateway':26B 'bulletin':75B,94B 'compon':43B 'connect':32B,41B,82B 'cvss':68B 'cwe':65B 'descript':91B 'director':47B 'disagre':95B 'fix':87B 'gateway':28B 'host':35B 'ibm':30B,37B,67B,73B 'ibm-api-connect':29B 'improp':59B 'l':71B 'list':76B 'network':72B 'neutralis':60B 'onprem':84B 'oper':64B 'potenti':105B 'pr':70B 'product':79B 'queri':63B 'redo':56B 'releas':51B 'say':38B 'self':34B 'self-host':33B 'stream':52B,97B 'treat':102B 'v10.0.8':50B,98B 'v12':83B 'v12.1':100B 'v12.1.0.0':85B 'v12.1.1.2':86B 'v12.1.1.3':89B 'v2':46B 'vendor':36B 'vs':99B 'vulner':54B 'wildcard':62B 'workaround':108B","search_c":"'10.0.8.0':112C '10.0.8.12':114C '12.1.0.0':116C '12.1.1.2':118C 'api':110C 'attack':129C 'connect':111C 'denial':125C 'express':124C 'ibm':109C 'improp':132C 'neutralis':133C 'oper':137C 'queri':136C 'redo':128C 'regular':123C 'servic':127C 'vulner':120C 'wildcard':135C","first_public_at":"2026-11-07T05:18:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18535","severity":null,"published_at":"2026-11-07T05:18:59+00:00","modified_at":"2026-11-07T05:18:59+00:00","first_seen_at":"2026-11-07T05:46:08+00:00","fetched_at":"2026-11-07T05:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18535:1962","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-37","severity":null,"published_at":"2026-11-07T05:50:02+00:00","modified_at":"2026-11-07T05:50:02+00:00","first_seen_at":"2026-11-07T05:50:02+00:00","fetched_at":"2026-11-07T05:50:02+00:00","note":"IBM bulletin -37 (v12.1.1.3) lists CVE-2026-18535: V12 OnPrem 12.1.0.0-12.1.1.2, fix 12.1.1.3, no workarounds. 10.0.8 stream named in description, but 10.0.8.13 bulletin (-41) doesn't list it; fix for 10.0.8 unknown. Auth requirement from CVSS PR:L only; endpoint not stated. Verified only workarounds/mitigations.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-37"]}],"documents":[{"id":93163,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-api-connect-37","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM API Connect (v12.1.1.3)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}