{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/maximo-application-suite---location-service-for-esri-component-9.0-9.1-9.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-18513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Maximo Application Suite - Location Service for Esri Component (9.0, 9.1, 9.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","access-control","ibm","kubernetes"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contains a vulnerability identified as CVE-2026-18513. The vulnerability stems from the use of a schema-less Custom Resource Definition (CRD) in the Kubernetes environment. This flaw leads to improper access control, which could be leveraged by an attacker to bypass intended security constraints within the application suite. As this component is integrated into the Maximo Application Suite, the exposure is significant for enterprise environments relying on Esri location-based services. Given the CVSS score of 7.2, defenders should prioritize patching or implementing compensating controls to restrict access to the affected CRD and associated API endpoints within their container orchestration platforms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this improper access control vulnerability could allow unauthorized users to perform actions restricted by standard security policies. This may result in unauthorized data access or service manipulation within the affected IBM Maximo environment. Enterprises utilizing versions 9.0, 9.1, or 9.2 of the Location Service for Esri Component are potentially exposed to these security risks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the IBM Maximo Application Suite - Location Service for Esri Component to a patched version once released by IBM to address the schema-less CRD vulnerability (CVE-2026-18513).\u003c/li\u003e\n\u003cli\u003eRestrict network access to the API endpoints and Kubernetes management interfaces associated with the Maximo Application Suite to trusted IP ranges only.\u003c/li\u003e\n\u003cli\u003eImplement Kubernetes RBAC policies to audit and limit the ability of service accounts and users to modify or access Custom Resource Definitions within the cluster.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:44:05Z","date_published":"2026-10-12T22:44:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-18513/","summary":"IBM Maximo Application Suite Location Service for Esri Component versions 9.0, 9.1, and 9.2 are vulnerable to improper access control due to a schema-less Custom Resource Definition, potentially allowing unauthorized access.","title":"Improper Access Control in IBM Maximo Application Suite Location Service","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-18513/"}],"language":"en","title":"CraftedSignal Threat Feed - Maximo Application Suite - Location Service for Esri Component (9.0, 9.1, 9.2)","version":"https://jsonfeed.org/version/1.1"}