CVE-2026-18513

Received Received - Intake

Improper Access Control in IBM Maximo Application Suite Location Service

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-18513

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Maximo	Application Suite - Location Service for Esri Component 9.2
IBM	Maximo	Application Suite - Location Service for Esri Component 9.1
IBM	Maximo	Application Suite - Location Service for Esri Component 9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

IBM Maximo Application Suite's Location Service for Esri Component has an improper access control flaw due to a schema-less Custom Resource Definition. This allows unauthorized users to potentially access or modify sensitive data.

Impact Analysis

An attacker could exploit this to gain elevated privileges, access confidential information, or disrupt services. The high CVSS score indicates significant risk of data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance risks legal penalties and reputational damage.

Mitigation Strategies

Apply the latest IBM Maximo Application Suite patch for the Location Service for Esri Component to address the improper access control issue. Restrict access to the Custom Resource Definition and review permissions to ensure least privilege.

Hi! I’m here to help you understand CVE-2026-18513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70