critical · CVSS v3 9.6

CVE-2026-18535

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) and impro

Overview

IBM API Connect versions 10.0.8.0-10.0.8.12 and 12.1.0.0-12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) and improper wildcard query handling, potentially allowing attackers to exhaust server resources or bypass query restrictions. This flaw can lead to service outages and unauthorized data exposure. It is critical for organizations running these API gateway products.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

Impact

The vulnerability can compromise confidentiality by enabling attackers to craft queries that bypass filters, integrity by allowing manipulation of query logic, and availability by causing denial of service through ReDoS. Defenders should monitor API traffic for anomalous patterns and ensure that query inputs are properly sanitized. The impact is significant for enterprises relying on IBM API Connect for public or internal API management.

Remediation

Apply the latest security patches that address CVE-2026-18535, specifically upgrading to IBM API Connect 10.0.8.13 or later, and 12.1.1.3 or later. If patching is not immediately possible, implement input validation to reject overly complex regular expressions and enforce strict whitelist of allowed characters in wildcard queries. Additionally, limit request rates and enable rate limiting on API endpoints.

Risk context

Given the critical severity (CVSS 9.6) and lack of EPSS data, the risk is high and requires prompt action. The vulnerability can be exploited by attackers with minimal effort to disrupt services.

Affected products

  • IBM API Connect 10.0.8.x
  • IBM API Connect 12.1.0.x

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.6
CVSS v4
—
EPSS
—

ReDoS API Connect Denial of Service Wildcard Query IBM Critical Input Validation

← All CVEs

Related CVEs

critical

CVE-2026-17362

IBM API Connect versions 12.1.0.0 to 12.1.1.2 contain a critical flaw that lets remote attackers create, modify, or delete tenants without proper authorization. This can compromise tenant isolation and data integrity. The vulnerability is exploitable via API calls without authentication.

View analysis

critical

CVE-2026-19803

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to arbitrary file upload that can lead to remote code execution for unauthenticated users when the Advanced Upload Popup is enabled. All versions up to 2.13.2 are affected, allowing attackers to write PHP files outside the uploads directory. This flaw enables attackers to compromise the entire site with no authentication required.

View analysis

critical

CVE-2026-93754

The payever WooCommerce Gateway plugin for WordPress allows unauthenticated file uploads that can lead to remote code execution. Vulnerable in all versions up to 4.8.0 due to missing authentication and file type validation. Attackers can upload malicious PHP files to the public uploads directory.

View analysis

critical

CVE-2026-16716

IBM API Connect versions 10.0.8.0‑12 and 12.1.0.0‑12.1.1.2 have a flaw that lets an authenticated user bypass security restrictions, enabling unauthorized access to sensitive data and configuration changes. The vulnerability is rated critical with a CVSS v3 score of 8.8.

View analysis