IBM Maximo Application Suite Location Service: Multiple CVEs (RCE, Command Injection, Access Control)

Vulnerability Overview IBM Maximo Application Suite - Location Service for Esri Component contains several security vulnerabilities, specifically: 1. CVE-2026-18513: Improper access control due to schema-less Custom Resource Definition. 2. CVE-2026-18537: Improper input validation due to uncleaned container image references in Kubernetes operator templates. 3. CVE-2026-18529: Command injection due to inadequate sanitization of user-controlled values in Kubernetes operator tasks. 4. CVE-2026-18533: Improper input validation due to uncleaned container image configuration in Kubernetes operator templates. 5. CVE-2026-18517: Unauthorized network egress due to misconfigured Kubernetes NetworkPolicy. 6. CVE-2026-88029: Improper neutralization of special elements in the data query logic within the GridFS component of the MongoDB Python Driver, which may lead to unintended reading or corruption of file contents. Affected Range IBM Maximo Application Suite - Location Service for Esri Component versions 9.2, 9.1, and 9.0 are affected. Remediation IBM Maximo Application Suite - Location Service for Esri Component version 9.2 must be upgraded to 9.2.3. IBM Maximo Application Suite - Location Service for Esri Component version 9.1 must be upgraded to 9.1.13. IBM Maximo Application Suite - Location Service for Esri Component version 9.0 must be upgraded to 9.0.14. Additional Information CVSS Score: The CVSS base scores for each vulnerability are 7.2, 8.7, 8.7, 6.5, 7.7, and 8.3, respectively. Last Modified Date: September 29, 2026. Initial Publication Date: September 29, 2026. References Complete CVSS v3 Guide On-line Calculator v3 Related Resources IBM Secure Engineering Web Portal IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an open industry standard designed to convey vulnerability severity and help determine response urgency and priorities. IBM provides CVSS scores "as is," without any expressed or implied warranties. Customers are responsible for assessing the potential impact of vulnerabilities on their environments. IBM regularly updates product component records to address potential vulnerabilities. The "affected products and versions" referenced in IBM security advisories refer only to IBM-supported and non-extended-support product versions. IBM does not provide fixes for unsupported or extended-support products and versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Maximo Application Suite Location Service: Multiple CVEs (RCE, Command Injection, Access Control)

More from this source