Command Injection Vulnerability in IBM Maximo Application Suite Location Service
CVE-2026-18529

8.7HIGH

Key Information:

Vendor

IBM
Status
Maximo Application Suite - Location Service For Esri Component
Vendor
CVE Published:
12 October 2026

What is CVE-2026-18529?

The IBM Maximo Application Suite Location Service, specifically in versions 9.2, 9.1, and 9.0, is exposed to a command injection vulnerability. This issue arises from inadequate sanitization of a user-controlled input, which can be manipulated and passed to a shell command within a Kubernetes operator task. Attackers could exploit this flaw to execute arbitrary commands, potentially compromising the security of the system.

Affected Version(s)

Maximo Application Suite - Location Service for Esri Component 9.2

Maximo Application Suite - Location Service for Esri Component 9.1

Maximo Application Suite - Location Service for Esri Component 9.0

References

https://www.ibm.com/support/pages/node/7290070
vendor-advisorypatch

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.