External risk intelligence

IBM API Connect ReDoS and Wildcard Query Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-18535

IBM API Connect is an enterprise API management solution designed to handle, expose, and secure API traffic. Given its core function as a gateway and management interface for external-facing services, it is commonly deployed in network locations that are reachable to facilitate API communication, making internet-facing exposure a standard and expected deployment pattern for this product.

Denial of Service

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in IBM API Connect, a platform used for managing APIs. The flaw could allow unauthorized access and disruption of services. The main concern is confirming relevance and exposure.

API management platform has critical vulnerabilities.
Affects external-facing services and data.
Confirm relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by sending specially crafted API requests to an exposed IBM API Connect instance. This could lead to a denial of service or allow an attacker to access sensitive information by exploiting how the system processes certain query inputs.

Requires authenticated access.
Triggered by specially crafted API requests.
Risks service disruption and data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to disrupt the availability of the API management service by sending specially crafted requests. When supported by the advisory, this could impact the service's ability to process legitimate API calls, leading to denial of service conditions and potential impact on downstream services that rely on the API.

API management service availability.
Specially crafted requests.
Disruption of legitimate API calls.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects IBM API Connect, impacting its ability to securely manage APIs. Infrastructure and platform teams are typically responsible for managing this technology. The immediate priority is to locate all instances of the affected IBM API Connect, assess their exposure and criticality, and identify the accountable system owner to begin risk-based remediation planning.

Ownership: Infrastructure and Platform Teams.
Verify: Identify all affected instances and exposure.
Action: Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM API Connect?

IBM API Connect is an enterprise-grade platform used to create, manage, secure, and monitor APIs across cloud and on-premises environments. It serves as a central gateway that regulates traffic between users and backend services, ensuring that data exchange is governed and reliable.

What does CVE-2026-18535 mean?

This CVE highlights two distinct weaknesses: Regular Expression Denial of Service (ReDoS) and improper neutralization of wildcard query operators. ReDoS occurs when complex pattern matching consumes excessive processing resources, while the wildcard flaw involves manipulating query logic. Together, they allow attackers to disrupt services or potentially access data they should not reach.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends specially crafted API requests to an affected instance. The system's processing logic for these inputs causes the issue. Note that simple, standard API traffic that does not contain these specific, malicious query patterns or regular expression structures will not trigger the vulnerability.

Why should I care about this vulnerability?

Halo Surface Signal indicates that IBM API Connect is often deployed in network locations intended to facilitate API communication, making it a common target. If your instance is internet-facing, it is directly reachable, increasing the risk of service disruption or data unauthorized access from remote actors.

Do I need to take action if I use this software?

Yes. First, locate all instances of the affected software within your infrastructure. Once identified, assess the risk based on the criticality of the services it manages and the level of network exposure. Coordinate with your platform and infrastructure teams to prioritize the planning of remediation steps according to your internal security policies.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.