CVE-2026-18531: IBM Maximo Application Suite

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.

Affected products

• IBM Maximo Application Suite: from 9.0, before 9.0.28 (fixed in 9.0.28); from 9.1, before 9.1.20 (fixed in 9.1.20); version 9.2 only

Published 2026-08-05. Last modified 2026-08-10.