The vulnerability arises from insufficient validation of container image references inside a Kubernetes operator template for the IBM Maximo Application Suite – Location Service for Esri Component. The flaw allows an attacker to supply a malicious image reference that is subsequently pulled and executed by the operator process, which can lead to arbitrary code execution within the host environment that runs the Maximo suite. This weakness is categorized as CWE‑94, reflecting unsanitised code execution via user‑supplied input.

IBM Maximo Application Suite – Location Service for Esri Component versions 9.2, 9.1, and 9.0 are affected. The flaw exists in the operator module that handles spatial data integration with Esri services across these releases.

The CVSS score of 8.7 signifies high severity, and although EPSS data is unavailable, the issue is not listed in CISA KEV. The likely attack vector requires an attacker to influence the Kubernetes operator configuration; this is inferred because the vulnerability is tied to an unsanitised image reference in the operator template. An administrator or privileged user who can modify the template can inject a harmful image, leading to execution of arbitrary code with operator privileges.