CVE-2026-18535: IBM API Connect Denial of Service
Published Oct 8, 2026
·Updated
BM API Connect Analytics (analytics-v2-director) versions in the v10.0.8 release stream are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
Other sources
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
— MITRE
Affected Software
1 affected component
IBM API Connect V12 OnPrem<=v12.1.0.0 - v12.1.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM API Connect (analytics-v2-director)to a version that resolves this vulnerability.Fixed in 10.0.8.13 - Upgrade
Upgrade
IBM API Connect (analytics-v2-director)to a version that resolves this vulnerability.Fixed in 12.1.1.3
Event History
Oct 8, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Nov 7, 2026
CVE Published
via MITRE·04:56 AM
Data Sourced
via MITRE·04:56 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:18 AM
DescriptionSeverityWeakness