CVE-2026-18535

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

Overview

State: PUBLISHED
Assigner (CNA): ibm
CVSS severity: CRITICAL
CVSS score: 9.6 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Effective score: 9.6 / 10 CRITICAL source: CNA overview
CWE(s): CWE-1333
Reserved: 2026-07-31
Published: 2026-11-07 04:56 UTC
Last updated: 2026-11-08 01:46 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18535.json
Linked Threat: CVE-2026-18535 — IBM API Connect Denial of Service

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-07 05:18:59 UTC
NVD last modified: 2026-11-08 02:17:04 UTC
NVD CVSS v3.1: 9.6 / 10 CRITICAL source: psirt@us.ibm.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Exploitability subscore: 3.1 / 10
Impact subscore: 5.8 / 10
EPSS score: 0.0029 (probability of exploitation in next 30 days)
EPSS percentile: 21.35% vs all CVEs — higher = more likely to be exploited, as of 2026-11-08

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-118926
Assigner: ibm
Published: Nov 7, 2026, 4:56:45 AM
Updated: Nov 8, 2026, 1:46:03 AM
EUVD base score (CVSS 3.1): 9.6 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
EUVD-reported EPSS: 0.2900
Vendors: IBM
Products: API Connect (10.0.8.0 ≤10.0.8.12)

API Connect (12.1.0.0 ≤12.1.1.2)
Aliases: GHSA-68pw-29w8-gp2w

ENISA description: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

EUVD references (2)

Affected products (1)

Vendor	Product	Versions	Platforms
IBM	API Connect	`12.1.0.0` (affected), `10.0.8.0` (affected)	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://www.ibm.com/support/pages/node/7291753 vendor-advisorypatch
https://www.ibm.com/support/pages/node/7292434 vendor-advisorypatch

MITRE references (2) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://www.ibm.com/support/pages/node/7291753 vendor-advisory, patch
https://www.ibm.com/support/pages/node/7292434 vendor-advisory, patch

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://www.ibm.com/support/pages/node/7291753 psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7292434 psirt@us.ibm.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-18535 — CVSS 9.6 CRITICAL | CTIWatch

web:ctiwatch.com

Technical Analysis CVE-2026-18535 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

2026-11-08 10:12 UTC
CVE-2026-18535: IBM API Connect Vulnerability - CVETodo

web:cvetodo.com

CVE-2026-18535 is a CVSS 9.6 critical-severity vulnerability in IBM API Connect. See exploitation status, patch guidance, and technical details.

2026-11-08 10:12 UTC
CISA Requires Federal Agencies to Patch Critical Vulnerabilities Within ...

web:cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.

2026-11-08 10:12 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-08 10:12 UTC
Security Advisory Ivanti Connect Secure (CVE-2026-104935)

web:hub.ivanti.com

These additional CVE disclosures have now been added to this Security Advisory and a fix is available now. 4. What actions has Ivanti taken in response to this discovery? Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0.

2026-11-08 10:12 UTC
Nvd-cve-2026-18535

web:nvd.nist.gov

HEADQUARTERS 100 Bureau Drive Gaithersburg, MD 20899 (301) 975-2000 Webmaster | Contact Us | Our Other Offices

2026-11-08 10:12 UTC
[Security Advisory] September 2026 CVE Advisory Notification

web:support.servicenow.com

What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...

2026-11-08 10:12 UTC
Ivanti Connect Secure: 2 New Zero-Day CVEs, Nov 13 [2026]

web:tech-insider.org

Ivanti Connect Secure is under active attack via 2 new CVEs . See affected versions, the Nov 13 patch deadline, and the mitigation steps to take today.

2026-11-08 10:12 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-08 10:12 UTC
CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect ...

web:www.cisa.gov

CISA has updated this Alert to: (1) include CVE - 2026 -111357 and CVE - 2026 -118527 and reflect their addition to the Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026 ; and (2) update the affected Ivanti Connect Secure versions.

2026-11-08 10:12 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-18535.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18535",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-08T01:45:54.241823Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-08T01:46:03.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "API Connect",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "12.1.1.2",
              "status": "affected",
              "version": "12.1.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.8.12",
              "status": "affected",
              "version": "10.0.8.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.</p>"
            }
          ],
          "value": "IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient regular expression complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T04:56:45.212Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7291753"
        },
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7292434"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3<br>Fix Central Link: <a href=\"https://www.ibm.com/support/pages/node/7290205\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/7290205</a></p><p>IBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13</p><p>Fix Central Link:<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&amp;product=ibm/WebSphere/IBM+API+Connect&amp;release=10.0.8.12&amp;platform=All&amp;function=all\" rel=\"nofollow\">https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&amp;product=ibm/WebSphere/IBM+API+Connect&amp;release=10.0.8.12&amp;platform=All&amp;function=all</a></p>"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3\nFix Central Link:  https://www.ibm.com/support/pages/node/7290205 \n\n\n\nIBM strongly recommends addressing the vulnerability now by upgrading to 10.0.8.13\n\n\n\nFix Central Link: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=10.0.8.12&platform=All&function=all"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM API Connect Denial of Service",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18535",
    "datePublished": "2026-11-07T04:56:45.212Z",
    "dateReserved": "2026-07-31T20:31:32.104Z",
    "dateUpdated": "2026-11-08T01:46:03.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}