{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aibmmaximo_application_suite9.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-75881"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Maximo Application Suite - IoT Component (9.0.0, 9.1.0, 9.2.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","iot"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability identified as CVE-2026-75881 that allows a remote, unauthenticated attacker to cause a denial of service (DoS). The issue stems from an improper input validation flaw within the component's parsing logic. When the application receives specially crafted input, it enters an infinite parsing loop. This condition leads to excessive resource consumption, specifically CPU exhaustion, which renders the service unavailable to legitimate users. Given the nature of the IoT component, this vulnerability could impact operational continuity in environments relying on this suite for device management and data ingestion. Organizations currently running the affected versions should review IBM security advisories for available patches or mitigation configurations to prevent potential service degradation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to an immediate denial of service, effectively halting the functionality of the IoT component within the Maximo Application Suite. This can result in significant operational disruption, especially in sectors managing large-scale IoT device networks. As the vulnerability is remote and requires only crafted inputs, the potential for widespread service instability is high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize the identification of all internet-facing or reachable IBM Maximo Application Suite - IoT Component instances within the environment.\u003c/li\u003e\n\u003cli\u003eApply available patches from IBM to resolve CVE-2026-75881 for versions 9.0.0, 9.1.0, and 9.2.0.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting and input validation at the web application firewall (WAF) or load balancer level to drop malformed traffic directed at the IoT component's ingestion endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:44:43Z","date_published":"2026-10-12T22:44:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ibm-maximo-dos/","summary":"IBM Maximo Application Suite IoT Component versions 9.0.0, 9.1.0, and 9.2.0 are susceptible to a remote denial of service vulnerability triggered by an infinite parsing loop.","title":"Denial of Service Vulnerability in IBM Maximo Application Suite IoT Component","url":"https://feed.craftedsignal.io/briefs/2026-10-ibm-maximo-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}