Description
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Published: 2026-10-12
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch Immediately
AI Analysis

Impact

IBM Maximo Application Suite versions 8.10 through 9.2 are vulnerable to a directory traversal flaw. A remote attacker can craft a URL that includes the sequence "/../" to cause the system to read arbitrary files located on the underlying host. The exposed files may contain configuration data or credentials, which would compromise confidentiality.

Affected Systems

Affected versions include IBM Maximo Application Suite 8.10.373.2.201, 8.11.344.0.179, 9.0.325.1.148, 9.1.266.3.60, 9.2.78.1.36 and all earlier releases within the same major‑version range. The vulnerability is present in all product releases of the CoreIDP component that rely on the coreidp‑login deployment.

Risk and Exploitability

The flaw carries a CVSS score of 7.5 (high). The EPSS score is not available, so the precise exploitation probability is unknown. It is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely by sending crafted HTTP requests with a path‑traversal payload, giving them unbounded read access to files on the host. Successful exploitation would give an attacker information that could be used for further attacks or compromise.

Generated by OpenCVE AI on October 12, 2026 at 23:30 UTC.

Remediation

Vendor Solution

A fix has been released for all supported MAS versions and will also be included in the next monthly update https://www.ibm.com/support/pages/node/6570601 . We strongly recommend applying this fix immediately rather than waiting for the monthly update. Remediated Product(s)Mas Verision(s)CoreIdp Version(s)IBM Maximo Application Suite8.10.373.2.201IBM Maximo Application Suite8.11.344.0.179IBM Maximo Application Suite9.0.325.1.148IBM Maximo Application Suite9.1.266.3.60IBM Maximo Application Suite9.2.78.1.36

Vendor Workaround

How To Apply the Fix * Open the OpenShift console and navigate to Administration > CustomResourceDefinitions.  * Search for coreidp. * Show coreidp instances. * Select the instance associated with your MAS installation; * Edit Coreidp CR for your instance with the following under spec.settings field: * Under the spec.settings field, add the following configuration, replacing <version> with the value specified in the table above for your MAS release: spec: settings: imageTags: coreidplogin: <version> * Save the change. This will trigger the Coreidp Entity Manager operator to reconcile and recreate the coreidp-login deployment automatically. * Wait for the new deployment to become ready, then follow the validation steps below.  IMPORTANT: Only remove the imageTags override from the Suite settings AFTER updating to the October 2026 monthly update or later, as earlier versions do not include the fix. Removing it before that point will revert your installation to the vulnerable version.

OpenCVE Recommended Actions

  • Apply the IBM-released fix for all supported MAS versions immediately; set the imageTags override to the version specified in the advisory.
  • If an immediate patch cannot be deployed, apply the workaround by editing the Coreidp CustomResourceDefinition to add an imageTag override for coreidp-login, then save to trigger redeployment.
  • Monitor system logs for unexpected file access attempts, and keep the imageTag override in place until a monthly update containing the fix is applied; thereafter, safely remove the override.

Generated by OpenCVE AI on October 12, 2026 at 23:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Title IBM Maximo Application Suite Information Disclosure
First Time appeared Ibm
Ibm maximo Application Suite
Weaknesses CWE-22
CPEs cpe:2.3:a:ibm:maximo_application_suite:8.10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm maximo Application Suite
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Ibm Maximo Application Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T21:05:04.599Z

Reserved: 2026-10-02T23:51:23.455Z

Link: CVE-2026-105052

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T21:17:08.300

Modified: 2026-10-12T21:17:08.300

Link: CVE-2026-105052

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T23:30:18Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')