IBM Maximo Application Suite – IoT Component versions 9.2.0, 9.1.0, and 9.0.0 contain a flaw that allows a remote attacker to trigger uncontrolled recursion, exhausting system resources and causing the component to become unresponsive. This results in a denial of service that impacts all users who rely on that component, without affecting confidentiality or integrity. The weakness is identified as CWE-674: Uncontrolled Recursion.

IBM Maximo Application Suite – IoT Component, affected in versions 9.2.0, 9.1.0, and 9.0.0. IBM recommends upgrading to version 9.2.3 or later, or to version 9.1.15 or later, or to version 9.0.24 or later to mitigate the flaw.

The CVSS score of 7.5 classifies the vulnerability as high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, indicating limited evidence of widespread exploitation. The likely attack vector is remote over the network, wherein an attacker could invoke recursive calls directly against the vulnerable component. While exploitation would not compromise data confidentiality or integrity, it would incapacitate the affected service, leading to availability loss for legitimate users.