IBM Maximo Application Suite vulnerabilities

35 CVEs affecting IBM Maximo Application Suite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-105052, published 2026-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-29854, published 2022-05-03. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a…
CVE-2021-38924, published 2022-09-14. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information…
CVE-2024-27266, published 2024-03-14. High severity, CVSS 8.2. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2024-22328, published 2024-04-06. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.10 and 8.11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences…
CVE-2023-32334, published 2023-06-05. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties…
CVE-2023-32332, published 2023-09-08. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would…
CVE-2026-105052, published 2026-10-12. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot…
CVE-2025-36386, published 2025-10-28. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
CVE-2022-35281, published 2023-01-09. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335.
CVE-2023-32335, published 2024-03-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.10, 8.11 and IBM Maximo Asset Management 7.6.1.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have…

Latest

CVE-2026-18531, published 2026-08-05. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret.
CVE-2026-15656, published 2026-08-05. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link…
CVE-2026-4820, published 2026-04-01. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http://…
CVE-2025-14684, published 2026-03-25. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when…
CVE-2025-2898, published 2025-05-06. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in Role-Based Access Control (RBAC)…
CVE-2023-43037, published 2025-04-10. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.
CVE-2025-1500, published 2025-04-05. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.
CVE-2024-35150, published 2025-01-25. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject false log entries.