The vulnerability is a command injection flaw in the IBM Maximo Application Suite Location Service for Esri Component. A user–controlled value is passed directly to a shell command in the Kubernetes operator task without proper sanitisation, allowing an attacker to execute arbitrary commands. This behaviour can compromise the underlying operating system and lead to full system takeover, affecting confidentiality, integrity, and availability of the affected installation. The weakness is identified as CWE-78, System Command Injection.

The compromise affects IBM Maximo Application Suite – Location Service for Esri Component versions 9.0, 9.1, and 9.2. The specific affected releases are 9.0.x, 9.1.x, and 9.2.x. IBM has issued remediation upgrades for each major line: 9.0.14, 9.1.13 and 9.2.3, which properly sanitise user input before invoking shell commands.

The CVSS score of 8.7 indicates high severity. While an EPSS score is not available, the lack of a CISA KEV listing suggests that no widespread exploitation has been observed yet, but the potential for exploitation remains high due to the nature of the command injection. The vulnerability is likely exploitable when the attacker has network access to the Kubernetes operator interface that accepts the untrusted input. If exploited, the attacker could gain elevated privileges within the cluster or execute arbitrary code at the host level.