Description
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Published: 2026-10-12
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Network Egress Violation
Action: Apply Patch
AI Analysis

Impact

IBM Maximo Application Suite – Location Service for Esri Component is vulnerable when its Kubernetes NetworkPolicy is misconfigured, allowing unintended outbound network connections. This improper access control can lead to unauthorized data exfiltration or allow attackers to communicate with external hosts from within the cluster. The weakness represents a CWE‑284 problem of insufficient authorization controls for network traffic, potentially affecting the confidentiality and integrity of sensitive data.

Affected Systems

The vulnerability affects IBM Maximo Application Suite – Location Service for Esri Component versions 9.0.x, 9.1.x, and 9.2.x. IBM has released remediated versions 9.0.14, 9.1.13, and 9.2.3, which address the misconfigured NetworkPolicy issue.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit this flaw by configuring or leveraging an existing misconfigured NetworkPolicy to send traffic to arbitrary external endpoints, potentially enabling data exfiltration or facilitating further lateral movement within the infrastructure. The exploitation requires either accidental or deliberate misconfiguration of the cluster, making it a significant risk for organizations running unsupported or mismanaged versions of the component.

Generated by OpenCVE AI on October 12, 2026 at 22:38 UTC.

Remediation

Vendor Solution

Remediated Product(s)Version(s)IBM Maximo Application Suite - Location Service for Esri Component Upgrade to 9.2.3 https://www.ibm.com/docs/en/masv-and-l/cd IBM Maximo Application Suite - Location Service for Esri Component Upgrade to 9.1.13 https://www.ibm.com/docs/en/masv-and-l/cd IBM Maximo Application Suite - Location Service for Esri Component Upgrade to 9.0.14 https://www.ibm.com/docs/en/masv-and-l/cd

OpenCVE Recommended Actions

  • Upgrade IBM Maximo Application Suite – Location Service for Esri Component to the latest cased versions: 9.2.3, 9.1.13, or 9.0.14, depending on your current release. 
  • Configure Kubernetes NetworkPolicies to explicitly limit egress traffic from the Esri component, permitting only approved destinations and protocols. 
  • Audit additional Kubernetes workloads for similar misconfigurations and apply appropriate network segmentation or policy enforcement to mitigate further exposure to unintended egress.

Generated by OpenCVE AI on October 12, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
Title IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
First Time appeared Ibm
Ibm maximo Application Suite Location Service For Esri Component
Weaknesses CWE-284
CPEs cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite_location_service_for_esri_component:9.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm maximo Application Suite Location Service For Esri Component
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Ibm Maximo Application Suite Location Service For Esri Component
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T21:03:07.117Z

Reserved: 2026-07-31T18:12:57.920Z

Link: CVE-2026-18517

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T21:17:16.517

Modified: 2026-10-12T21:17:16.517

Link: CVE-2026-18517

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T22:45:16Z

Weaknesses