Cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aibmmaximo_application_suite/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 22:44:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Access Control in IBM Maximo Application Suite Location Servicehttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-18513/Mon, 12 Oct 2026 22:44:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-18513/IBM Maximo Application Suite Location Service for Esri Component versions 9.0, 9.1, and 9.2 are vulnerable to improper access control due to a schema-less Custom Resource Definition, potentially allowing unauthorized access.IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contains a vulnerability identified as CVE-2026-18513. The vulnerability stems from the use of a schema-less Custom Resource Definition (CRD) in the Kubernetes environment. This flaw leads to improper access control, which could be leveraged by an attacker to bypass intended security constraints within the application suite. As this component is integrated into the Maximo Application Suite, the exposure is significant for enterprise environments relying on Esri location-based services. Given the CVSS score of 7.2, defenders should prioritize patching or implementing compensating controls to restrict access to the affected CRD and associated API endpoints within their container orchestration platforms.

Impact

Successful exploitation of this improper access control vulnerability could allow unauthorized users to perform actions restricted by standard security policies. This may result in unauthorized data access or service manipulation within the affected IBM Maximo environment. Enterprises utilizing versions 9.0, 9.1, or 9.2 of the Location Service for Esri Component are potentially exposed to these security risks.

Recommendation

  • Upgrade the IBM Maximo Application Suite - Location Service for Esri Component to a patched version once released by IBM to address the schema-less CRD vulnerability (CVE-2026-18513).
  • Restrict network access to the API endpoints and Kubernetes management interfaces associated with the Maximo Application Suite to trusted IP ranges only.
  • Implement Kubernetes RBAC policies to audit and limit the ability of service accounts and users to modify or access Custom Resource Definitions within the cluster.
]]>highadvisoryvulnerabilityaccess-controlibmkubernetes